Actively exploited · Published Nov 23, 2020 · Assigned by vmware

CVE-2020-4006

Critical 9.1 Exploited

In plain English

A critical-severity OS command injection in VMware Workspace One Access (Access), VMware Workspace One Access Connector (Access Connector), VMware Identity Manager (vIDM), VMware Identity Manager Connector (vIDM Connector), VMware Cloud Foundat. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 17.3% (higher than 97% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)17.3%top 2.9% of all CVEs

Exploited in the wildYesCISA KEV since Nov 3, 2021

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 3, 2022.

Official description

VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability.

Affected products (as reported)

Vendor	Product	Versions
n/a	VMware Workspace One Access (Access), VMware Workspace One Access Connector (Access Connector), VMware Identity Manager (vIDM), VMware Identity Manager Connector (vIDM Connector), VMware Cloud Foundation, vRealize Suite Lifecycle Manager	Multiple

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

https://www.vmware.com/security/advisories/VMSA-2020-0027.html x_refsource_MISC
https://www.kb.cert.org/vuls/id/724367
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-4006 government-resource