« Volver al listado

CVE-2021-22056

Estado: ModificadaAlta (7.5)—

VMware Workspace ONE Access 21.08, 20.10.0.1, and 20.10 and Identity Manager 3.3.5, 3.3.4, and 3.3.3 contain an SSRF vulnerability. A malicious actor with network access may be able to make HTTP requests to arbitrary origins and read the full response.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Vmware — Identity ManagerVmware — Vrealize AutomationVmware — Workspace ONE Access

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-22056",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "VMware Workspace ONE Access and Identity Manager",
          "versions": [
            {
              "status": "affected",
              "version": "VMware Workspace ONE Access 21.08, 20.10.0.1, and 20.10 and Identity Manager 3.3.5, 3.3.4, and 3.3.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-12-20T21:15:07.960",
  "references": [
    {
      "url": "https://www.vmware.com/security/advisories/VMSA-2021-0030.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "https://www.vmware.com/security/advisories/VMSA-2021-0030.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "VMware Workspace ONE Access 21.08, 20.10.0.1, and 20.10 and Identity Manager 3.3.5, 3.3.4, and 3.3.3 contain an SSRF vulnerability. A malicious actor with network access may be able to make HTTP requests to arbitrary origins and read the full response."
    },
    {
      "lang": "es",
      "value": "VMware Workspace ONE Access versiones 21.08, 20.10.0.1 y 20.10 y Identity Manager versiones 3.3.5, 3.3.4 y 3.3.3, contienen una vulnerabilidad de tipo SSRF. Un actor malicioso con acceso a la red puede ser capaz de realizar peticiones HTTP a orígenes arbitrarios y leer la respuesta completa"
    }
  ],
  "lastModified": "2026-06-17T03:36:37.250",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:identity_manager:3.3.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "97D98937-489B-4AA5-B99E-9AB639C582CA"
            },
            {
              "criteria": "cpe:2.3:a:vmware:identity_manager:3.3.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0E93CB5E-CB4A-474A-9901-2E098928C489"
            },
            {
              "criteria": "cpe:2.3:a:vmware:identity_manager:3.3.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2A215A7D-F644-41DE-AB4E-69145DA48F9F"
            },
            {
              "criteria": "cpe:2.3:a:vmware:vrealize_automation:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3F5937FC-B5FF-432C-9120-7138D0FD7665",
              "versionEndIncluding": "8.6",
              "versionStartIncluding": "8.0"
            },
            {
              "criteria": "cpe:2.3:a:vmware:vrealize_automation:7.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "471BB5AF-3744-45FE-937D-BBEC421035EB"
            },
            {
              "criteria": "cpe:2.3:a:vmware:workspace_one_access:20.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EDC57F3A-E726-4EE5-924D-9C94FED4718D"
            },
            {
              "criteria": "cpe:2.3:a:vmware:workspace_one_access:20.10.01:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6C2F7CB4-8425-4D9F-97FC-AD96D9ABC202"
            },
            {
              "criteria": "cpe:2.3:a:vmware:workspace_one_access:21.08:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A6D31E45-25F5-4842-98FD-2CD68D2C786B"
            },
            {
              "criteria": "cpe:2.3:a:vmware:workspace_one_access:21.08.01:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "90BB4A84-0BE5-4228-AB80-33E04B7716C3"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "security@vmware.com"
}