Veille CVE
CVE-2021-22054
7.5 Élevée Exploitée activementCatalogue CISA KEV — Omnissa Workspace ONE Server-Side Request Forgery
Ajoutée le 09/03/2026 · Échéance de correction (agences US) : 23/03/2026
Action requise : Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 7.5 Élevée | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | 7.5 Élevée | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 2.0 | 5.0 Moyenne | nvd@nist.gov (NVD) | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Faiblesses (CWE)
Références
- https://www.vmware.com/security/advisories/VMSA-2021-0029.html PatchVendor Advisory
- https://www.vmware.com/security/advisories/VMSA-2021-0029.html PatchVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22054 US Government Resource
- https://www.greynoise.io/blog/new-ssrf-exploitation-surge Third Party Advisory