VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor with local access can escalate privileges to root.
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cloud_foundation | Vmware | 3.0 (including) | 5.0 (excluding) |
| Identity_manager | Vmware | 3.3.3 (including) | 3.3.3 (including) |
| Identity_manager | Vmware | 3.3.4 (including) | 3.3.4 (including) |
| Identity_manager | Vmware | 3.3.5 (including) | 3.3.5 (including) |
| Identity_manager | Vmware | 3.3.6 (including) | 3.3.6 (including) |
| Vrealize_automation | Vmware | 8.0 (including) | 9.0 (excluding) |
| Vrealize_automation | Vmware | 7.6 (including) | 7.6 (including) |
| Vrealize_suite_lifecycle_manager | Vmware | 8.0 (including) | 9.0 (excluding) |
| Workspace_one_access | Vmware | 20.10.0.0 (including) | 20.10.0.0 (including) |
| Workspace_one_access | Vmware | 20.10.0.1 (including) | 20.10.0.1 (including) |
| Workspace_one_access | Vmware | 21.08.0.0 (including) | 21.08.0.0 (including) |
| Workspace_one_access | Vmware | 21.08.0.1 (including) | 21.08.0.1 (including) |