XSS in VMware Workspace One Unified Endpoint Management
CVE-2021-21990
VMware Workspace one UEM console (2102 prior to 21.2.0.8, 2101 prior to 21.1.0.14, 2011 prior to 20.11.0.27, 2010 prior to 20.10.0.16,2008 prior to 20.8.0.28, 2007 prior to 20.7.0.14,2006 prior to 20.6.0.19, 2005 prior to 20.5.0.46, 2004 prior to 20.4.0.21, 2003 prior to 20.3.0.23, 2001 prior to 20.1.0.32, 1912 prior to 19.12.0.24) contain a cross-site scripting vulnerability. VMware Workspace ONE UEM console does not validate incoming requests during device enrollment after leading to rendering of unsanitized input on the user device in response.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.008 (52.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Vmware Workspace_one_unified_endpoint_management
- N/a Vmware Workspace One Uem Console — versions VMware Workspace one UEM console (2102 prior to 21.2.0.8, 2101 prior to 21.1.0.14, 2011 prior to 20.11.0.27, 2010 prior to 20.10.0.16,2008 prior to 20.8.0.28, 2007 prior to 20.7.0.14,2006 prior to 20.6.0.19, 2005 prior to 20.5.0.46, 2004 prior to 20.4.0.21, 2003 prior to 20.3.0.23, 2001 prior to 20.1.0.32, 1912 prior to 19.12.0.24)
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@vmware.com (x_refsource_MISC, Vendor Advisory)
- security@vmware.com (Exploit, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-21990?
- CVE-2021-21990 is a medium-severity vulnerability in VMware Workspace One Unified Endpoint Management, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2021-05-11.
- How severe is CVE-2021-21990?
- Medium severity. CVSS v3 base score is 6.1 out of 10.
- Is CVE-2021-21990 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.