« Volver al listado

CVE-2021-22003

Estado: ModificadaAlta (7.5)—

VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443. A malicious actor with network access to port 7443 may attempt user enumeration or brute force the login endpoint, which may or may not be practical based on lockout policy configuration and password complexity for the target account.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Vmware — Cloud FoundationVmware — Identity ManagerVmware — Vrealize Suite Lifecycle ManagerVmware — Workspace ONE Access

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-22003",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "VMware Workspace ONE Access and Identity Manager",
          "versions": [
            {
              "status": "affected",
              "version": "Workspace ONE Access 20.10.01, 20.10 & 20.01. Identity Manager 3.3.5, 3.3.4, 3.3.3 & 3.3.2."
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-08-31T22:15:08.367",
  "references": [
    {
      "url": "https://www.vmware.com/security/advisories/VMSA-2021-0016.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "https://www.vmware.com/security/advisories/VMSA-2021-0016.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-307"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443. A malicious actor with network access to port 7443 may attempt user enumeration or brute force the login endpoint, which may or may not be practical based on lockout policy configuration and password complexity for the target account."
    },
    {
      "lang": "es",
      "value": "VMware Workspace ONE Access y Identity Manager, proporcionan sin intención una interfaz de inicio de sesión en el puerto 7443. Un actor malicioso con acceso a la red al puerto 7443 puede intentar enumerar a usuarios o forzar el endpoint de inicio de sesión, que puede o no ser práctico basado en la configuración de la política de bloqueo y la complejidad de la contraseña de la cuenta de destino"
    }
  ],
  "lastModified": "2026-06-17T03:36:32.230",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:identity_manager:3.3.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "22BC2D96-5922-4995-B006-1BAB5FE51D93"
            },
            {
              "criteria": "cpe:2.3:a:vmware:identity_manager:3.3.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "97D98937-489B-4AA5-B99E-9AB639C582CA"
            },
            {
              "criteria": "cpe:2.3:a:vmware:identity_manager:3.3.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0E93CB5E-CB4A-474A-9901-2E098928C489"
            },
            {
              "criteria": "cpe:2.3:a:vmware:identity_manager:3.3.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2A215A7D-F644-41DE-AB4E-69145DA48F9F"
            },
            {
              "criteria": "cpe:2.3:a:vmware:workspace_one_access:20.01:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FFFD453B-7658-4FDA-BA4D-B13681F51724"
            },
            {
              "criteria": "cpe:2.3:a:vmware:workspace_one_access:20.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EDC57F3A-E726-4EE5-924D-9C94FED4718D"
            },
            {
              "criteria": "cpe:2.3:a:vmware:workspace_one_access:20.10.01:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6C2F7CB4-8425-4D9F-97FC-AD96D9ABC202"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:cloud_foundation:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "38EB0C0C-56CF-4A8F-A36F-E0E180B9059E"
            },
            {
              "criteria": "cpe:2.3:a:vmware:cloud_foundation:4.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A54544F5-5929-4609-A91C-FCA0FDBFE862"
            },
            {
              "criteria": "cpe:2.3:a:vmware:cloud_foundation:4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CA6D6348-E71A-4DA4-AC84-51397B2461A2"
            },
            {
              "criteria": "cpe:2.3:a:vmware:cloud_foundation:4.1.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C8EC0B43-8667-45D6-BF97-03DDFFAD2AF9"
            },
            {
              "criteria": "cpe:2.3:a:vmware:cloud_foundation:4.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DC4C5700-1AFE-49F6-AC92-09F2349345ED"
            },
            {
              "criteria": "cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E3318D91-40AC-4649-8FCD-4557C8F934B9"
            },
            {
              "criteria": "cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A06C29AB-1EAF-43EF-96C3-9E3468911B2F"
            },
            {
              "criteria": "cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43723EC2-295E-4AF7-B654-70F9E42F4807"
            },
            {
              "criteria": "cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CFB84C30-EE5D-4C15-A74E-7B2B3E0DED4D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@vmware.com"
}