critical9.1Known exploited
CVE-2020-4006
Multiple VMware Products Command Injection Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-11-03. Federal due date: 2022-05-03.
Apply updates per vendor instructions.
Impact
VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vmware | Identity Manager | Versions 3.3.1, 3.3.2, 3.3.3 |
| Vmware | Identity Manager Connector | Versions 3.3.1, 3.3.2, 3.3.3 |
| Vmware | One Access | Versions 20.01, 20.10 |
| Vmware | Cloud Foundation | Versions 4.0, 4.0.1 |
| Vmware | Vrealize Suite Lifecycle Manager | from 8.0 through 8.2 |