CISA has asked VMware admins and users today to patch a critical security vulnerability found in the Workspace ONE UEM console that threat actors could abuse to gain access to sensitive information.
Workspace ONE Unified Endpoint Management (ONE UEM) is a VMware solution for over-the-air remote management of desktops, mobile, rugged, wearables, and IoT devices.
The flaw tracked as
CVE-2021-22054 is a server side request forgery (SSRF) vulnerability with a severity rating of 9.1/10 and impacting multiple ONE UEM console versions.
Unauthenticated threat actors can exploit this vulnerability remotely in low-complexity attacks without user interaction.
"A malicious actor with network access to UEM can send their requests without authentication and may exploit this issue to gain access to sensitive information," VMware explained in a
security advisory issued on Thursday.
"CISA encourages users and administrators to review VMware Security Advisory VMSA-2021-0029 and apply the necessary mitigation," CISA
said today.
