CVE-2023-20884

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-05-30 · updated 2026-06-17
Weakness: CWE-601

Description

VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. An unauthenticated malicious actor may be able to redirect a victim to an attacker controlled domain due to improper path handling leading to sensitive information disclosure.

Affected products

VMware Cloud Foundation: all versions
VMware Identity Manager: 3.3.6, 3.3.7
VMware Identity Manager Connector: all versions
VMware Workspace ONE Access: from 21.0.8.0 through 22.09.1.0
VMware Workspace ONE Access (Access), VMware Identity Manager (vIDM), VMware Cloud Foundation (Cloud Foundation): Workspace ONE Access 22.09.1.0, Workspace ONE Access 22.09.0.0, Workspace ONE Access 21.08.x, VMware Identity Manager 3.3.7, VMware Identity Manager 3.3.6

References

Get alerted when CVE-2023-20884 or the next vulnerability affects your stack