VMware has addressed a critical SSRF vulnerability, tracked as CVE-2021-22054, in Workspace ONE UEM console.
An attacker with network access to UEM could exploit the vulnerability to access sensitive data in the management console. An attacker can trigger the issue by sending unauthenticated requests to the vulnerable software.
The virtualization giant has rated the issue as Critical and assigned it a CVSSv3 base score of 9.1. The SSRF vulnerability in Workspace ONE UEM console was patched by th VMware and provided workarounds.
The company fixed the issue with the release of VMware Workspace ONE UEM console versions 220.127.116.11, 18.104.22.168, 22.214.171.124, and 126.96.36.199. VMware Workspace ONE UEM patch 188.8.131.52 and above also fixed the vulnerability.
Shared and Dedicated SaaS:
The issue has been mitigated across all SaaS environments through infrastructure changes which will remain in place until VMware Cloud Operations has deployed the necessary patches. Please subscribe to this article to be notified when updates are available
Deploy the patch associated with the supported version of Workspace ONE UEM that your environment is on. The company also shared the following required actions in guidance for addressing CVE-2021-22054.