CVE-2021-22056

VMware Workspace ONE Access 21.08, 20.10.0.1, and 20.10 and Identity Manager 3.3.5, 3.3.4, and 3.3.3 contain an SSRF vulnerability. A malicious actor with network access may be able to make HTTP requests to arbitrary origins and read the full response.

Published: Dec 20, 2021
Updated: Apr 14, 2023
CVE: CVE-2021-22056
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2:

Severity: Medium
Score: 5
AV:N/AC:L/Au:N/C:P/I:N/A:N

CWEs:

CWE-918

Affected Software
References

Software	From	Fixed in
vmware / identity_manager	3.3.3	3.3.3.x
vmware / identity_manager	3.3.4	3.3.4.x
vmware / identity_manager	3.3.5	3.3.5.x
vmware / vrealize_automation	8.0	8.6.x
vmware / vrealize_automation	7.6	7.6.x
vmware / workspace_one_access	20.10	20.10.x
vmware / workspace_one_access	20.10.01	20.10.01.x
vmware / workspace_one_access	21.08	21.08.x
vmware / workspace_one_access	21.08.01	21.08.01.x

https://www.vmware.com/security/advisories/VMSA-2021-0030.html

Vulnerability Database

CVE-2021-22056

Deep Security Visibility Without the Complexity