CVE-2021-22002
First published: Tue Aug 31 2021(Updated: )
VMware Workspace ONE Access and Identity Manager, allow the /cfg web app and diagnostic endpoints, on port 8443, to be accessed via port 443 using a custom host header. A malicious actor with network access to port 443 could tamper with host headers to facilitate access to the /cfg web app, in addition a malicious actor could access /cfg diagnostic endpoints without authentication.
Credit: security@vmware.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| VMware Identity Manager | =3.3.2 | |
| VMware Identity Manager | =3.3.3 | |
| VMware Identity Manager | =3.3.4 | |
| VMware Identity Manager | =3.3.5 | |
| VMware Workspace ONE Access | =20.01 | |
| VMware Workspace ONE Access | =20.10 | |
| VMware Workspace ONE Access | =20.10.01 | |
| Linux Linux kernel | ||
| VMware Cloud Foundation | =4.0 | |
| VMware Cloud Foundation | =4.0.1 | |
| VMware Cloud Foundation | =4.1 | |
| VMware Cloud Foundation | =4.1.0.1 | |
| VMware Cloud Foundation | =4.2.1 | |
| Vmware Vrealize Suite Lifecycle Manager | =8.0 | |
| Vmware Vrealize Suite Lifecycle Manager | =8.0.1 | |
| Vmware Vrealize Suite Lifecycle Manager | =8.1 | |
| Vmware Vrealize Suite Lifecycle Manager | =8.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2021-22002?
CVE-2021-22002 is a vulnerability in VMware Workspace ONE Access and Identity Manager that allows the /cfg web app and diagnostic endpoints on port 8443 to be accessed via port 443 using a custom host header.
Which software versions are affected by CVE-2021-22002?
CVE-2021-22002 affects VMware Identity Manager versions 3.3.2, 3.3.3, 3.3.4, and 3.3.5, as well as VMware Workspace ONE Access versions 20.01, 20.10, and 20.10.01.
How severe is CVE-2021-22002?
CVE-2021-22002 has a severity rating of 9.8 (Critical).
How can an attacker exploit CVE-2021-22002?
An attacker with network access to port 443 could tamper with host headers to gain unauthorized access to the /cfg web app in VMware Workspace ONE Access and Identity Manager.
Is the Linux Linux kernel vulnerable to CVE-2021-22002?
No, the Linux Linux kernel is not vulnerable to CVE-2021-22002.
- collector/nvd-index
- agent/weakness
- agent/author
- agent/severity
- agent/references
- agent/type
- agent/description
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- agent/event
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/vmware
- canonical/vmware identity manager
- version/vmware identity manager/3.3.2
- version/vmware identity manager/3.3.3
- version/vmware identity manager/3.3.4
- version/vmware identity manager/3.3.5
- canonical/vmware workspace one access
- version/vmware workspace one access/20.01
- version/vmware workspace one access/20.10
- version/vmware workspace one access/20.10.01
- vendor/linux
- canonical/linux linux kernel
- canonical/vmware cloud foundation
- version/vmware cloud foundation/4.0
- version/vmware cloud foundation/4.0.1
- version/vmware cloud foundation/4.1
- version/vmware cloud foundation/4.1.0.1
- version/vmware cloud foundation/4.2.1
- canonical/vmware vrealize suite lifecycle manager
- version/vmware vrealize suite lifecycle manager/8.0
- version/vmware vrealize suite lifecycle manager/8.0.1
- version/vmware vrealize suite lifecycle manager/8.1
- version/vmware vrealize suite lifecycle manager/8.2