CVE-2017-4951 VMware AirWatch Console (9.2.x before 9.2.2 and 9.1.x before 9.1.5) contains a Cross Site Request Forgery vulnerability when accessing the App Catalog. An attacker may exploit this issue by tricking u...
HighCVSS 8.8
EPSS 0.83%
- Published
- Updated
- Exploit status
- No public exploit known
Description
VMware AirWatch Console (9.2.x before 9.2.2 and 9.1.x before 9.1.5) contains a Cross Site Request Forgery vulnerability when accessing the App Catalog. An attacker may exploit this issue by tricking users into installing a malicious application on their devices.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| VMware airwatch | >= 9.1, < 9.1.5 | 9.1.5 |
| VMware airwatch | >= 9.2, < 9.2.2 | 9.2.2 |
| VMware airwatch console | = 9.2.x before 9.2.2 | No fix listed |
| VMware airwatch console | = 9.1.x before 9.1.5 | No fix listed |
References
- 102849 third-party-advisory vdb-entry
- 1040288 third-party-advisory vdb-entry
- www.vmware.com patch vendor-advisory