PT-2021-6852 · Vmware · Vmware Workspace One Access+1

Published 2021-12-16 · Updated 2022-11-03 · CVE-2021-22057

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware Workspace ONE Access versions 20.10 through 21.08

Description The issue is related to an authentication bypass vulnerability in the VMware Verify component of the Workspace ONE Access platform. This vulnerability is associated with weaknesses in the authentication procedure. A malicious actor who has successfully provided first-factor authentication may be able to obtain second-factor authentication provided by VMware Verify, potentially allowing a remote attacker to disclose protected information.

Recommendations For versions 20.10 through 21.08, consider temporarily disabling the VMware Verify component for second-factor authentication until a patch is available. Restrict access to the Workspace ONE Access platform to minimize the risk of exploitation. Avoid relying solely on the affected authentication mechanism until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2022-02327

CVE-2021-22057

Affected Products

Vmware Verify

Vmware Workspace One Access

References · 6

• https://vmware.com/security/advisories/VMSA-2021-0030.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22057 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02327 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-22057 · Security Note
• https://t.me/cibsecurity/34306 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021122001 · Note