Overview
VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector are vulnerable to command injection in the administrative configurator. This could allow a remote attacker to execute commands with unrestricted privileges on the underlying operating system.
Description
VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector are vulnerable to command injection in the administrative configurator. This could allow a remote attacker with access to the administrative configurator on port 8443 and a valid password to execute commands with unrestricted privileges on the underlying operating system. For additional details, please see VMSA-2020-0027 and CVE-2020-4006.
Impact
This could allow a malicious actor with network access to the administrative configurator on port 8443 and a valid password for the configurator admin account to execute commands with unrestricted privileges on the underlying operating system.
Active exploitation of this vulnerability has been reported.
Solution
VMware has released updates as described in VMSA-2020-0027.
Workarounds
VMware has documented workarounds in VMSA-2020-0027.
Acknowledgements
Thanks to VMware for coordinating this vulnerability.
This document was written by Madison Oliver.
Vendor Information
Other Information
| CVE IDs: | CVE-2020-4006 |
| Date Public: | 2020-11-23 |
| Date First Published: | 2020-11-23 |
| Date Last Updated: | 2020-12-08 15:53 UTC |
| Document Revision: | 5 |