SAML Authentication Bypass in VMware Workspace ONE Unified Endpoint Management Console
CVE-2018-6979

7.4HIGH

Key Information:

Vendor

Vmware
Status
Vmware Workspace One Unified Endpoint Management Console (airwatch Console)
Vendor
CVE Published:
4 October 2018

What is CVE-2018-6979?

The VMware Workspace ONE Unified Endpoint Management Console contains a vulnerability that allows attackers to bypass SAML authentication during device enrollment. If certificate-based authentication is enabled, this could lead to unauthorized access by impersonating a legitimate SAML session. Even if certificate-based authentication is not enabled, exploitation of this flaw could result in information disclosure, highlighting the critical need for system updates and enhanced security measures in affected versions.

Affected Version(s)

VMware Workspace ONE Unified Endpoint Management Console (AirWatch Console) 9.7.x prior to 9.7.0.8

VMware Workspace ONE Unified Endpoint Management Console (AirWatch Console) 9.6.x prior to 9.6.0.8

VMware Workspace ONE Unified Endpoint Management Console (AirWatch Console) 9.5.x prior to 9.5.0.17

References

https://www.vmware.com/security/advisories/VMSA-2018-0024...
x_refsource_CONFIRM
http://www.securitytracker.com/id/1041808
vdb-entryx_refsource_SECTRACK

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2018-6979 : SAML Authentication Bypass in VMware Workspace ONE Unified Endpoint Management Console