Security News > 2021 > August > VMware Issues Patches to Fix Critical Bugs Affecting Multiple Products

VMware has released security updates for multiple products to address a critical vulnerability that could be exploited to gain access to confidential information.

CVE-2021-22002 concerns an issue with how VMware Workspace One Access and Identity Manager allow the "/cfg" web app and diagnostic endpoints to be accessed via port 443 by tampering with a host header, resulting in a server-side request.

"A malicious actor with network access to port 443 could tamper with host headers to facilitate access to the /cfg web app, in addition a malicious actor could access /cfg diagnostic endpoints without authentication," the company said in its advisory.

Also addressed by VMware is an information disclosure vulnerability impacting VMware Workspace One Access and Identity Manager through an inadvertently exposed login interface on port 7443.

An attacker with network access to port 7443 could potentially stage a brute-force attack, which the firm noted: "May or may not be practical based on lockout policy configuration and password complexity for the target account."

For customers who cannot upgrade to the latest version, VMware is offering a workaround script for CVE-2021-22002 that can be deployed independently without taking the vRA appliances offline.

News URL

http://feedproxy.google.com/~r/TheHackersNews/~3/eXRJh4_7sV0/vmware-issues-patches-to-fix-critical.html