CVE-2020-3940

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-01-17 · updated 2026-06-17
Weakness: CWE-295

Description

VMware Workspace ONE SDK and dependent mobile application updates address sensitive information disclosure vulnerability.

Affected products

VMware Workspace ONE Boxer: before 5.13.1 — fixed in 5.13.1
VMware Workspace ONE Content: before 3.21; before 4.20 — fixed in 3.21, 4.20
VMware Workspace One Intelligent Hub: before 19.11.1 — fixed in 19.11.1
VMware Workspace One Notebook: before 1.2.1 — fixed in 1.2.1
VMware Workspace One People: before 1.3.2 — fixed in 1.3.2
VMware Workspace One Piv-D Manager: before 1.4.2 — fixed in 1.4.2
VMware Workspace ONE SDK: before 1.4.1; before 1.5.1; from 19.8.0 before 19.11.1 — fixed in 1.4.1, 1.5.1, 19.11.1
VMware Workspace One Sdk (Objective-C): from 5.9.9.7 before 5.9.9.8 — fixed in 5.9.9.8
VMware Workspace One Web: before 7.10.8 — fixed in 7.10.8
VMware Workspace ONE SDK: Workspace ONE SDK for Android prior to 19.11.1 and Workspace ONE SDK for iOS (Objective-C) prior to 5.9.9.8

How to fix

Upgrade to a fixed version: VMware Workspace ONE Boxer 5.13.1; VMware Workspace ONE Content 3.21, 4.20; VMware Workspace One Intelligent Hub 19.11.1; VMware Workspace One Notebook 1.2.1; VMware Workspace One People 1.3.2; VMware Workspace One Piv-D Manager 1.4.2; VMware Workspace ONE SDK 1.4.1, 1.5.1, 19.11.1; VMware Workspace One Sdk (Objective-C) 5.9.9.8; VMware Workspace One Web 7.10.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-3940 or the next vulnerability affects your stack