PT-2021-3778 · Vmware · Vmware Workspace One Access+1

Published 2021-08-05 · Updated 2021-09-09 · CVE-2021-22003

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions VMware Workspace ONE Access and Identity Manager (affected versions not specified)

Description The issue is related to the unintentional provision of a login interface on port 7443, which may allow a malicious actor with network access to attempt user enumeration or brute force the login endpoint. The practicality of such attempts depends on the lockout policy configuration and password complexity for the target account. Additionally, there is a concern about the transmission of data over an insecure primary channel, which could enable a remote attacker to bypass existing security restrictions using a brute force attack.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-419

CWE-307

Related Identifiers

BDU:2021-04034

CVE-2021-22003

Affected Products

Vmware Identity Manager

Vmware Workspace One Access

References · 8

• https://osv.dev/vulnerability/CVE-2021-22003 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04034 · Security Note
• https://vmware.com/security/advisories/VMSA-2021-0016.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22003 · Security Note
• https://cybersecurity-help.cz/vdb/SB2021080526 · Note
• https://t.me/cibsecurity/28142 · Telegram Post
• https://t.me/cvenotify/20476 · Telegram Post
• https://vmware.com/security/advisories/VMSA-2021-0016.htm · Note