CVE-2020-4006

high-risk

Published 2020-11-23

VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability.

Do I need to act?

12.8% chance of exploitation in next 30 days

EPSS score — higher than 87% of all CVEs

CISA KEV: actively exploited in the wild

On the Known Exploited Vulnerabilities catalog — federal agencies must patch

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.1/10 Critical

NETWORK / LOW complexity

Identity Manager

Identity Manager Connector

One Access

Identity Manager Connector

Cloud Foundation

Vrealize Suite Lifecycle Manager

Vmware

Vendor Advisory https://www.vmware.com/security/advisories/VMSA-2020-0027.html

Third Party Advisory https://www.kb.cert.org/vuls/id/724367

Vendor Advisory https://www.vmware.com/security/advisories/VMSA-2020-0027.html

US Government Resource https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-...

/ 100

high-risk

Severity 31/34 · Critical

Exploitability 19/34 · Moderate

Exposure 16/34 · Moderate