• VMware Workspace ONE Access (Access)
• VMware Identity Manager (vIDM)
• VMware vRealize Automation (vRA)
• VMware Cloud Foundation (Cloud Foundation) 
• vRealize Suite Lifecycle Manager

Multiple vulnerabilities were privately reported to VMware. Patches and workarounds are available to address these vulnerabilities in affected VMware products.

VMware Workspace ONE Access and Identity Manager, allow the /cfg web app and diagnostic endpoints, on port 8443, to be accessed via port 443 using a custom host header. VMware has evaluated this issue to be of 'Important' severity with a maximum CVSSv3 base score of 8.6.

A malicious actor with network access to port 443 could tamper with host headers to facilitate access to the /cfg web app, in addition a malicious actor could access /cfg diagnostic endpoints without authentication.

Fixes for CVE-2021-22002 are documented in the 'Fixed Version' column of the 'Response Matrix' below.

Workarounds for CVE-2021-22002 are documented in the 'Workarounds' column of the 'Response Matrix' below.

KB70911 "Cumulative Update for vRealize Automation 7.6" provides a link to download vRealize Automation 7.6 Patch 23, which includes a fix for this vulnerability.

[1] vRealize Automation 7.6 is affected since it uses embedded vIDM.

[2] vRealize Automation 8.x is unaffected since it does not use embedded vIDM. If vIDM has been deployed with vRA 8.x, fixes should be applied directly to vIDM.

VMware would like to thank Suleyman Bayir of Trendyol and Mehmet İnce of PRODAFT SARL for reporting this issue to us.

VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443. VMware has evaluated this issue to be of 'Low' severity with a maximum CVSSv3 base score of 3.7.

A malicious actor with network access to port 7443 may attempt user enumeration or brute force the login endpoint, which may or may not be practical based on lockout policy configuration and password complexity for the target account. 

Fixes for CVE-2021-22003 are documented in the 'Fixed Version' column of the 'Response Matrix' below.

None.

None.

[2] vRealize Automation 8.x is unaffected since it does not use embedded vIDM. If vIDM has been deployed with vRA 8.x, fixes should be applied directly to vIDM.

None.

Fixed Version:

https://kb.vmware.com/s/article/85254

https://kb.vmware.com/s/article/70911

Workarounds:

https://kb.vmware.com/s/article/85255

Mitre CVE Dictionary Links:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22002

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22003

FIRST CVSSv3 Calculator:

CVE-2021-22002 - https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

CVE-2021-22003 - https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

2021-08-05 VMSA-2021-0016

Initial Security Advisory.

2021-08-12 VMSA-2021-0016.1

Added VMware Workspace ONE Access 20.01 to Response Matrix.

2021-11-12 VMSA-2021-0016.2

Added vRealize Automation 7.6 Patch 23 to Response Matrix.

E-mail list for product security notifications and announcements:

https://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce 

This Security Advisory is posted to the following lists:  

[email protected]  

[email protected]  

[email protected] 

E-mail: [email protected]

PGP key at:

https://kb.vmware.com/kb/1055 

VMware Security Advisories

https://www.vmware.com/security/advisories 

VMware Security Response Policy

https://www.vmware.com/support/policies/security_response.html 

VMware Lifecycle Support Phases

https://www.vmware.com/support/policies/lifecycle.html 

VMware Security & Compliance Blog  

https://blogs.vmware.com/security 

Twitter

https://twitter.com/VMwareSRC

Copyright 2021 VMware Inc. All rights reserved.