Paper/Archive/CVE-2020-4006

CVE-2020-4006

VMware Multiple Products — Multiple VMware Products Command Injection Vulnerability

KEV · due 3 May EPSS 17%public exploit SSVC act CVSS 9.1

CVSS 9.1 (ADP)9.1 / 10 × 3027.3 In CISA KEV+3030.0 EPSS percentile 97.1.971 × 2019.4 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability.

Affected

ProductAffectedFixed inSource

VMware Workspace One Access (Access), VMware Workspace One Access Connector (Access Connector), VMware Identity Manager (vIDM), VMware Identity Manager Connector (vIDM Connector), VMware Cloud Foundation, vRealize Suite Lifecycle ManagerMultiple–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: active · Automatable: no · Technical impact: total

References

refvmware.com/security/advisories/VMSA-2020-0027.html refkb.cert.org/vuls/id/724367 refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-4006 kevcisa.gov/known-exploited-vulnerabilities-catalog