CVE-2020-4006

VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability.

Score

CVSS 3.1 9.1 Critical

Status

Analyzed - security@vmware.com

Published

2020-11-23

Last modified

2025-10-21

Known exploited (CISA KEV)

since 2021-11-03, action due 2022-05-03: Apply updates per vendor instructions.

Weaknesses

CWE-78

Affected products

• Cloud Foundation (Vmware)
• Identity Manager (Vmware)
• Identity Manager Connector (Vmware)
• One Access (Vmware)
• Vrealize Suite Lifecycle Manager (Vmware)

References

• https://www.vmware.com/security/advisories/VMSA-2020-0027.html
• https://www.kb.cert.org/vuls/id/724367
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-4006