Author: Melodie Foster
Date: 4th December 2020
The zero-day bug was flagged in late November by the U.S. Cybersecurity and Infrastructure Security Agency after it was reported to them by the National Security Agency. It affected VMware versions across its Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector administrative configurator portfolios for both Windows and Linux operating systems.
VMware wrote about the flaw in a blog post, “a malicious actor with network access to the administrative configurator on port 8443 and a valid password for the configurator admin account can execute commands with unrestricted privileges on the underlying operating system.”
The CVSS rating for the bug has decreased from 9.1 out of 10 to 7.2 after further investigation into the vulnerability showed that an attacker would need the password which would make it harder to exploit. This brings the CVSS severity rating for the flaw from critical to “important”. The blog post mentioned that the password would have to be obtained by tactics like phishing, brute forcing or credential stuffing.
After the flaw was first discovered in November, VMware issued a “temporary solution” and there were no reports of exploitation in the wild. However, now that a full patch is available it is recommended to upgrade your VMware software.
Cyberfort Colocation Services
Cyberfort has invested heavily in secure infrastructure, making us the perfect colocation service provider to host your mission-critical, sensitive and regulated data.
Find out more >
Cyberfort Deep Dives
Cyberfort’s cybersecurity consultants explore issues in cyber threat intelligence, incident planning and data security. Read our whitepapers to help make decisions that benefit your business.
Find out more >