PT-2023-6684 · Vmware · Vmware Workspace One Uem

Published 2023-10-31 · Updated 2023-11-08 · CVE-2023-20886

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VMware Workspace ONE UEM (affected versions not specified)

Description The issue is related to an open redirect vulnerability in the VMware Workspace ONE UEM console. This vulnerability can be exploited by a malicious actor to redirect a victim to an attacker's site, allowing the attacker to retrieve the victim's SAML response and login as the victim user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2023-07454

CVE-2023-20886

Affected Products

Vmware Workspace One Uem

References · 9

• https://bdu.fstec.ru/vul/2023-07454 · Security Note
• https://osv.dev/vulnerability/CVE-2023-20886 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-20886 · Security Note
• https://vmware.com/security/advisories/VMSA-2023-0025.html · Vendor Advisory
• https://t.me/cvenotify/60262 · Telegram Post
• https://twitter.com/CVEnew/status/1719457447864386007 · Twitter Post
• https://t.me/pentestingnews/40661 · Telegram Post
• https://t.me/cibsecurity/73277 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1719484846236418240 · Twitter Post