CVE-2023-20886

Published: Oct 31, 2023Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

VMware Workspace ONE UEM console contains an open redirect vulnerability. A malicious actor may be able to redirect a victim to an attacker and retrieve their SAML response to login as the victim user.

Affected (5)

Products: Vmware: Workspace One Uem

Vmware

1 product

Workspace One Uem

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Vmware Workspace One Uem	From 22.12.0.1 to 22.12.0.20
Vmware Workspace One Uem	From 22.3.0.2 to 22.3.0.48
Vmware Workspace One Uem	From 22.6.0.1 to 22.6.0.36
Vmware Workspace One Uem	From 22.9.0.1 to 22.9.0.29
Vmware Workspace One Uem	From 23.2.0.1 to 23.2.0.10

Related CWEs

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

References (2)

https://www.vmware.com/security/advisories/VMSA-2023-0025.html

Source: security@vmware.com

Vendor Advisory

https://www.vmware.com/security/advisories/VMSA-2023-0025.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.