CRITICAL🚩 CISA KEV⚡ EXPLOIT🇵🇱 Wersja polska

CVE-2020-4006

CVSS 9.1v3.1pub. 2020-11-23upd. 2025-10-30

VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Linux Kernel
OS
Linux
wszystkie wersje
Microsoft Windows
OS
Microsoft
wszystkie wersje
VMware Cloud Foundation
APP
Vmware
4.04.0.1
VMware Identity Manager
APP
Vmware
3.3.13.3.23.3.3
VMware Identity Manager Connector
APP
Vmware
3.3.13.3.23.3.3
VMware One Access
APP
Vmware
20.0120.10
VMware Vrealize Suite Lifecycle Manager
APP
Vmware
8.0 – 8.2

CISA KEV — detailsi

Vendori: VMware ↗
Producti: Multiple Products
Added to KEVi: November 3, 2021
Remediation deadline (US Federal)i: May 3, 2022(overdue)

🔧Advisory VMware↗🇺🇸CISA KEV (original)↗

Required action (CISA)i

Apply updates per vendor instructions.

CISA descriptioni

VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a command injection vulnerability. An attacker with network access to the administrative configurator on port 8443 and a valid password for the configurator administrator account can execute commands with unrestricted privileges on the underlying operating system.

🔴