CVE-2021-22054
high · 7.5Actively exploitedOn the CISA Known Exploited Vulnerabilities catalog
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
A public exploit / detection template exists
Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →
VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| vmware | workspace_one_uem_console | >= 20.0.8.0, < 20.0.8.36 |
| vmware | workspace_one_uem_console | >= 20.11.0.0, < 20.11.0.40 |
| vmware | workspace_one_uem_console | >= 21.2.0.0, < 21.2.0.27 |
| vmware | workspace_one_uem_console | >= 21.5.0.0, < 21.5.0.37 |
Check a specific version with /api/v1/cve/match.
References
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2021-22054