CVE-2020-4006 vulnerability in VMware Products
Published on November 23, 2020

VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability.

Vendor Advisory NVD

Known Exploited Vulnerability

This VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector Comm vulnerability is part of CISA's list of Known Exploited Vulnerabilities. VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability.

The following remediation steps are recommended / required by May 3, 2022: Apply updates per vendor instructions.

Vulnerability Analysis

CVE-2020-4006 is exploitable with network access, and requires user privileges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.3 out of four. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.

What is a Command Injection Vulnerability?

The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

CVE-2020-4006 has been classified to as a Command Injection vulnerability or weakness.

Products Associated with CVE-2020-4006

You can be notified by stack.watch whenever vulnerabilities like CVE-2020-4006 are published in these products:

VMware Cloud Foundation

VMware Vrealize Suite Lifecycle Manager

What versions are vulnerable to CVE-2020-4006?

Each of the following must match for the vulnerability to exist.