CVE-2017-4951

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-01-29 · updated 2026-06-17
Weakness: CWE-352

Description

VMware AirWatch Console (9.2.x before 9.2.2 and 9.1.x before 9.1.5) contains a Cross Site Request Forgery vulnerability when accessing the App Catalog. An attacker may exploit this issue by tricking users into installing a malicious application on their devices.

Affected products

VMware AirWatch Console (AWC): from 9.1 before 9.1.5; from 9.2 before 9.2.2 — fixed in 9.1.5, 9.2.2
VMware Airwatch Console: 9.2.x before 9.2.2, 9.1.x before 9.1.5

How to fix

Upgrade to a fixed version: VMware AirWatch Console (AWC) 9.1.5, 9.2.2. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/102849
http://www.securitytracker.com/id/1040288
https://www.vmware.com/security/advisories/VMSA-2018-0006.html
http://www.securityfocus.com/bid/102849
http://www.securitytracker.com/id/1040288
https://www.vmware.com/security/advisories/VMSA-2018-0006.html

Get alerted when CVE-2017-4951 or the next vulnerability affects your stack