What is CVE-2023-20886?

CVE-2023-20886 is a vulnerability found in the VMware Workspace ONE UEM console that allows an attacker to perform an open redirect and retrieve a victim's SAML response.

How does CVE-2023-20886 affect VMware Workspace ONE UEM console?

CVE-2023-20886 affects the VMware Workspace ONE UEM console by enabling a malicious actor to redirect a victim to an attacker and steal their SAML response for unauthorized access.

What is the severity of CVE-2023-20886?

CVE-2023-20886 has a severity rating of 8.8 (high).

Which versions of VMware Workspace ONE UEM are affected by CVE-2023-20886?

CVE-2023-20886 affects VMware Workspace ONE UEM versions from 22.3.0.2 to 22.3.0.48, 22.6.0.1 to 22.6.0.36, 22.9.0.1 to 22.9.0.29, 22.12.0.1 to 22.12.0.20, and 23.2.0.1 to 23.2.0.10.

How can I fix the CVE-2023-20886 vulnerability in VMware Workspace ONE UEM console?

To fix the CVE-2023-20886 vulnerability in VMware Workspace ONE UEM console, it is recommended to upgrade to a version that is not affected by the vulnerability.

Vulnerability/
CVE-2023-20886

high

8.8

CWE

601

31/10/2023

12/9/2024

CVE-2023-20886

First published: Tue Oct 31 2023(Updated: )

VMware Workspace ONE UEM console contains an open redirect vulnerability. A malicious actor may be able to redirect a victim to an attacker and retrieve their SAML response to login as the victim user.

Credit: security@vmware.com

Affected Software	Affected Version	How to fix
VMware Workspace ONE UEM	>=22.3.0.2<22.3.0.48
VMware Workspace ONE UEM	>=22.6.0.1<22.6.0.36
VMware Workspace ONE UEM	>=22.9.0.1<22.9.0.29
VMware Workspace ONE UEM	>=22.12.0.1<22.12.0.20
VMware Workspace ONE UEM	>=23.2.0.1<23.2.0.10

Never miss a vulnerability like this again

Reference Links

https://www.vmware.com/security/advisories/VMSA-2023-0025.html

Frequently Asked Questions

What is CVE-2023-20886?
CVE-2023-20886 is a vulnerability found in the VMware Workspace ONE UEM console that allows an attacker to perform an open redirect and retrieve a victim's SAML response.
How does CVE-2023-20886 affect VMware Workspace ONE UEM console?
CVE-2023-20886 affects the VMware Workspace ONE UEM console by enabling a malicious actor to redirect a victim to an attacker and steal their SAML response for unauthorized access.
What is the severity of CVE-2023-20886?
CVE-2023-20886 has a severity rating of 8.8 (high).
Which versions of VMware Workspace ONE UEM are affected by CVE-2023-20886?
CVE-2023-20886 affects VMware Workspace ONE UEM versions from 22.3.0.2 to 22.3.0.48, 22.6.0.1 to 22.6.0.36, 22.9.0.1 to 22.9.0.29, 22.12.0.1 to 22.12.0.20, and 23.2.0.1 to 23.2.0.10.
How can I fix the CVE-2023-20886 vulnerability in VMware Workspace ONE UEM console?
To fix the CVE-2023-20886 vulnerability in VMware Workspace ONE UEM console, it is recommended to upgrade to a version that is not affected by the vulnerability.

collector/nvd-api
agent/references
agent/author
agent/severity
agent/weakness
agent/type
agent/tags
agent/event
agent/description
agent/last-modified-date
agent/softwarecombine
agent/first-publish-date
collector/mitre-cve
source/MITRE
vendor/vmware
canonical/vmware workspace one uem
version/vmware workspace one uem/22.3.0.2
version/vmware workspace one uem/22.6.0.1
version/vmware workspace one uem/22.9.0.1
version/vmware workspace one uem/22.12.0.1
version/vmware workspace one uem/23.2.0.1

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.