CVE-2023-20886

Summary

VMware Workspace ONE UEM console contains an open redirect vulnerability.

A malicious actor may be able to redirect a victim to an attacker and retrieve their SAML response to login as the victim user.

Affected Software

VendorProductVersion RangeStatus
n/aVMware Workspace ONE UEM ConsoleWorkspace ONE UEM 23.6.0.0unaffected
n/aVMware Workspace ONE UEM ConsoleWorkspace ONE UEM 23.2.0.0affected
n/aVMware Workspace ONE UEM ConsoleWorkspace ONE UEM 22.12.0.0affected
n/aVMware Workspace ONE UEM ConsoleWorkspace ONE UEM 22.9.0.0affected
n/aVMware Workspace ONE UEM ConsoleWorkspace ONE UEM 22.6.0.0affected
n/aVMware Workspace ONE UEM ConsoleWorkspace ONE UEM 22.3.0.0affected

Weaknesses

  • CWE-601: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References