OMSA-2024-0001

James Dean

10 months ago

Moderate

Advisory ID:
OMSA-2024-0001

CVSSv3 Range:
6.8

Issue Date:
2024-06-27

Updated On:
2024-06-27 (Initial Advisory)

CVE(s):
CVE-2024-22260

Synopsis:
VMware Workspace One UEM update addresses an information exposure vulnerability (CVE-2024-22260)

1. Impacted Products

VMware Workspace ONE UEM

2. Introduction

A vulnerability affecting Workspace ONE UEM endpoints was responsibly reported to VMware. Updates are available to remediate this vulnerability in affected VMware products.

3. Injection Vulnerability (CVE-2024-22260)

Description

Workspace ONE UEM endpoints contain an information exposure vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 6.8.

Known Attack Vectors

A malicious actor with network access to the Workspace One UEM may be able to perform an attack resulting in an information exposure.

Resolution

To remediate CVE-2024-22260 apply the updates listed in the ‘Fixed Version’ column of the ‘Response Matrix’ below.

Workarounds

None.

Additional Documentation

None.

Notes

None.

Acknowledgements

VMware would like to thank Emre Durmaz and Nuri Yavuz of Company Trendyol for reporting this vulnerability to us.

Response Matrix

Product	Version	Running On	CVE Identifier	CVSSv3	Severity	Fixed Version	Workarounds	Additional Documentation
VMware Workspace One UEM	23.10.x	Any	CVE-2024-22260	6.8	moderate	23.10.0.13	None	None
VMware Workspace One UEM	23.6.x	Any	CVE-2024-22260	6.8	moderate	23.6.0.30	None	None
VMware Workspace ONE UEM	23.2.x	Any	CVE-2024-22260	6.8	moderate	23.2.0.46	None	None
VMware Workspace One UEM	22.12.x	Any	CVE-2024-22260	6.8	moderate	22.12.0.47	None	None