{"vulnerability": "cve-2021-22054", "sightings": [{"uuid": "7dbd4daf-235f-45c0-9ce3-70fdee428237", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22054", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/116200818148253024", "content": "", "creation_timestamp": "2026-03-09T19:16:13.584505Z"}, {"uuid": "ee394fcb-1660-49ed-bae0-a7285ec990f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22054", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/5968446", "content": "", "creation_timestamp": "2026-03-09T20:21:54.820391Z"}, {"uuid": "1780cefe-9138-4452-a119-fa9c9e0c245f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22054", "type": "seen", "source": "https://thehackernews.com/2026/03/cisa-flags-solarwinds-ivanti-and.html", "content": "", "creation_timestamp": "2026-03-10T05:17:00.000000Z"}, {"uuid": "d379824c-4f5e-4a63-9277-1cc5a379ce52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-22054", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-011/", "content": "", "creation_timestamp": "2026-03-16T00:00:00.000000Z"}, {"uuid": "19de60b1-a7b7-4232-acc4-79d049782290", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-22054", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/0361e2ef-9298-4c7a-82e3-9876dff4863b", "content": "", "creation_timestamp": "2026-03-09T20:00:02.740109Z"}, {"uuid": "915fde67-f917-48c2-bded-f8ba0791d5bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22054", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-df887e70-aaa85e643f2fa245", "content": "", "creation_timestamp": "2026-03-13T15:12:35.298833Z"}, {"uuid": "cc17b502-a75e-4dd1-a926-43b3de7d193e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22054", "type": "seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mhbup66jae27", "content": "", "creation_timestamp": "2026-03-17T21:03:21.339031Z"}, {"uuid": "00de366c-f90a-47eb-b3d1-6b79ccd38ae2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-22054", "type": "seen", "source": "https://www.cisa.gov/news-events/alerts/2026/03/09/cisa-adds-three-known-exploited-vulnerabilities-catalog", "content": "", "creation_timestamp": "2026-03-09T12:00:00.000000Z"}, {"uuid": "d3a2a2f7-d850-4a71-92fc-d6368d82c66a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22054", "type": "published-proof-of-concept", "source": "https://t.me/cKure/9432", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 Encrypting our way to SSRF in VMWare Workspace One UEM (CVE-2021-22054).\n\nhttps://blog.assetnote.io/2022/04/27/vmware-workspace-one-uem-ssrf/", "creation_timestamp": "2022-04-27T17:05:37.000000Z"}, {"uuid": "e370b1eb-8ddd-4aee-81f5-c47a82bbefaf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22054", "type": "seen", "source": "https://t.me/poxek/1471", "content": "Encrypting our way to SSRF in VMWare Workspace One UEM (CVE-2021-22054)\n\u25b6\ufe0f \u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a\n\n\u0414\u043d\u0435\u0432\u043d\u0438\u043a \u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a\u0430 \ud83d\udee1", "creation_timestamp": "2022-05-04T09:00:48.000000Z"}, {"uuid": "a0f804f8-0d86-496c-bb60-8a6a7623305c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22054", "type": "exploited", "source": "https://t.me/true_secator/6843", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 GreyNoise \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u044e\u0442 \u043e\u0431 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0441\u043a\u043e\u043e\u0440\u0434\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u043c\u0430\u0441\u0441\u043e\u0432\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u043f\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 SSRF, \u043e\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c.\n\n\u0410\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0441\u0442\u0430\u0440\u0442\u043e\u0432\u0430\u043b\u0430 9 \u043c\u0430\u0440\u0442\u0430, \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0433\u0440\u0443\u043f\u043f\u0430 \u0438\u0437 400 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432.\n\n\u0410\u0442\u0430\u043a\u0438 \u0431\u044b\u043b\u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u0438 SSRF \u0432 Zimbra, GitLab, DotNetNuke, VMware, ColumbiaSoft, Ivanti, BerriAI \u0438 OpenBMCS \u0438 \u043c\u043d\u043e\u0433\u0438\u0445 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\u0445.\n\n\u0411\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0430\u0442\u0430\u043a \u0431\u044b\u043b\u0438 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u043d\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0421\u0428\u0410, \u0413\u0435\u0440\u043c\u0430\u043d\u0438\u0438, \u0418\u043d\u0434\u0438\u0438, \u042f\u043f\u043e\u043d\u0438\u0438 \u0438 \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0435, \u043d\u043e \u043d\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435 \u043e\u0441\u043e\u0431\u043e\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c\u0438 \u0431\u044b\u043b\u043e \u0443\u0434\u0435\u043b\u0435\u043d\u043e \u0418\u0437\u0440\u0430\u0438\u043b\u044e \u0438 \u041d\u0438\u0434\u0435\u0440\u043b\u0430\u043d\u0434\u0430\u043c.\n\n\u0412 \u0447\u0438\u0441\u043b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 SSRF: \n- CVE-2017-0929\u00a0(CVSS: 7,5, DotNetNuke), \n- CVE-2020-7796\u00a0(CVSS: 9,8, Zimbra Collaboration Suite, \n- CVE-2021-21973\u00a0(CVSS: 5,3, VMware vCenter, \n- CVE-2021-22054\u00a0(CVSS: 7,5, VMware Workspace ONE UEM), \n- CVE-2021-22175\u00a0(CVSS: 9,8, GitLab CE/EE, \n- CVE-2021-22214\u00a0(CVSS: 8,6) \u0438 CVE-2021-39935\u00a0(CVSS: 7,5, GitLab CE/EE), \n- CVE-2023-5830\u00a0(CVSS: 9,8, ColumbiaSoft DocumentLocator), \n- CVE-2024-6587\u00a0(CVSS: 7,5, BerriAI LiteLLM), \n- CVE-2024-21893\u00a0(CVSS: 8,2, Ivanti Connect Secure),\n- OpenBMCS 2.4\u00a0\u0438 Zimbra Collaboration Suite\u00a0(\u0431\u0435\u0437 CVE).\n\n\u041a\u0430\u043a \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442 GreyNoise, \u043c\u043d\u043e\u0433\u0438\u0435 \u0438\u0437 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043d\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 SSRF, \u043e\u0442\u043c\u0435\u0447\u0430\u044f, \u0447\u0442\u043e \u0448\u0430\u0431\u043b\u043e\u043d \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0435\u043c\u043e\u0439  \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e, \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u044e \u0438\u043b\u0438 \u0441\u0431\u043e\u0440 \u0440\u0430\u0437\u0432\u0435\u0434\u044b\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043f\u0435\u0440\u0435\u0434 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0435\u0439.\n\n\u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 SSRF \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0442\u044c \u043a\u0430\u0440\u0442\u044b \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0445 \u0441\u0435\u0442\u0435\u0439, \u0432\u044b\u044f\u0432\u043b\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u0438 \u043a\u0440\u0430\u0441\u0442\u044c \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0434\u043b\u044f \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432.\n\nGreyNoise \u043e\u0442\u043c\u0435\u0442\u0438\u043b\u0430, \u0447\u0442\u043e \u0442\u0430\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u044b\u0433\u0440\u0430\u043b\u0438 \u0432\u0430\u0436\u043d\u0443\u044e \u0440\u043e\u043b\u044c \u0432\u00a0\u0443\u0442\u0435\u0447\u043a\u0435 Capital One\u00a0\u0432 2019 \u0433\u043e\u0434\u0443, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0430 \u0431\u043e\u043b\u0435\u0435 100 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.\n\n\u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c\u0438 \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u043c\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043a\u0440\u0430\u0439\u043d\u0435 \u0432\u0430\u0436\u043d\u043e \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f, \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u043c\u0438 \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u043c\u0438 \u0442\u043e\u0447\u043a\u0430\u043c\u0438 \u0438 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b.", "creation_timestamp": "2025-03-14T15:30:06.000000Z"}, {"uuid": "039d6be9-8f75-4c27-a651-ddc67a084a10", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22054", "type": "published-proof-of-concept", "source": "https://t.me/thebugbountyhunter/6207", "content": "Encrypting our way to SSRF in VMWare Workspace One UEM (CVE-2021-22054)\n\nhttps://blog.assetnote.io/2022/04/27/vmware-workspace-one-uem-ssrf/", "creation_timestamp": "2022-04-27T09:49:16.000000Z"}, {"uuid": "a7abf3e3-b97a-42c1-9ddb-4e405eab12f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22054", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/5901", "content": "#Threat_Research\n1. Encrypting our way to SSRF in VMWare Workspace One UEM (CVE-2021-22054)\nhttps://blog.assetnote.io/2022/04/27/vmware-workspace-one-uem-ssrf\n2. RCE via VirusTotal Platform\nhttps://www.cysrc.com/blog/virus-total-blog", "creation_timestamp": "2022-04-28T11:00:01.000000Z"}, {"uuid": "0142b6e4-cab9-40b6-b2af-57128c16a837", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22054", "type": "seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mtba5inn4s2t", "content": "\ud83d\udea8 A 4-year-old bug is still your biggest threat.\n\nCVE-2021-22054.\n\nhttps://www.yazoul.net/malware/vidar-2026-08/reports/2026-08-16/\n\nby Yazoul AI #CyberSecurity #Security", "creation_timestamp": "2026-08-17T07:57:52.626876Z"}, {"uuid": "e5e0c30e-d64b-4a84-83f6-6f8bf4e4d088", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22054", "type": "seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mtbiug4wrj2j", "content": "Why are attackers still exploiting a 2021 VMware bug?\n\nCVE-2021-22054.\n\nhttps://www.yazoul.net/malware/mirai-2026-08/reports/2026-08-16/\n\nby Yazoul AI #CVE #CyberSecurity", "creation_timestamp": "2026-08-17T10:33:51.660866Z"}, {"uuid": "72a726cb-9dd2-4a42-a4a2-6446c3b1372a", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22054", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/5ce0c791-95e7-42b5-bf59-4218c3f4fad8", "content": "", "creation_timestamp": "2026-06-19T12:45:15.323433Z"}, {"uuid": "c00dd421-1eb4-4efa-87b8-390353c9395b", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22054", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f64c6a48-007c-45cc-90a5-a8181b58c7e6", "content": "", "creation_timestamp": "2026-06-23T14:03:42.038105Z"}, {"uuid": "18333e70-14bd-48e2-8fb0-daae2df09c00", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-22054", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/775fb1e1-01a5-48b8-885b-907b95e11c08", "content": "", "creation_timestamp": "2026-06-30T09:42:44.405998Z"}, {"uuid": "6fc4de46-228b-4972-b2dd-2a6624b450b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22054", "type": "seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mtdplotgwq2t", "content": "Why are we still patching a 2021 bug in 2025?\n\nCVE-2021-22054.\n\nhttps://www.yazoul.net/malware/vidar-2026-08/reports/2026-08-16/\n\nby Yazoul AI #CVE #CyberSecurity", "creation_timestamp": "2026-08-18T07:39:34.826075Z"}, {"uuid": "d595c5be-3e88-458c-851b-a207fcdd83e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22054", "type": "seen", "source": "https://t.me/hacking_Attack/52213", "content": "Black Hat Ethical Hacking\nSecurity bug in VMWare Workspace ONE could allow access to internal, cloud networks\n\nSecurity bug in VMWare Workspace ONE could allow access to internal, cloud networksPost Views: 32 \nPremium Content\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-2.png Subscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nA security vulnerability in a mobile device management software could allow attackers access to organizations\u2019 internal and cloud networks, researchers warn.\nDiscovered by Assetnote, the server-side request forgery\u00a0(SSRF) bug was found in VMWare Workspace One UEM.\n\nTracked as CVE-2021-22054, the vulnerability could risk credentials and other sensitive data falling into the hands of malicious attackers.\n\n\u201cWe discovered a pre-authentication vulnerability that allowed us to make arbitrary HTTP requests, including requests with any HTTP method and request body,\u201d the researchers wrote in a blog post.\n\n\u201cIn order to exploit this SSRF, we had to reverse engineer the encryption algorithm used by VMWare Workspace One UEM.\u201d\n\nThe team were able to breach \u201ca number of\u201d organizations\u00a0using the software, accessing both their internal network and cloud services.\n\nSpeaking to The Daily Swig, Assetnote\u2019s Subham Shah said: \u201cWhile I cannot share exact details about what companies were effected, there were a large number of enterprises that were vulnerable to this.\n\n\u201cIn some cases, it was possible to use this vulnerability to breach the AWS accounts of the companies.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Shah added: \u201cThe impact of this vulnerability is rather on the organization running the software, instead of the individual users that are using the products.\n\u201cUsing the SSRF vulnerability, it is possible to reach arbitrary hosts on the internal network. On cloud\u00a0networks such as AWS, it is possible to reach the metadata IP address and potentially steal security credentials.\n\n\u201cUsing these security credentials, it is possible to escalate the vulnerability to gain access to other infrastructure belonging to a company.\u201d\nSee Also: New Nimbuspwn Linux vulnerability gives hackers root privileges RemediationsThe issue, which was first discovered in November 2021, has since been patched by the vendor.\n\nShah said that while VMware dealt with the issues \u201cin a timely manner\u201d, researchers agreed to the vendor\u2019s request for more time to release more patches and allow customers to patch their instances before disclosure.\n\nAn advisory from VMWare\u00a0contains details of fixes for the software.\n\nShah advised users of mobile management device software \u201cif possible, do not expose the MDM solution to the external internet\u201d. See Also: OSINT Tool: MOSINT Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Darkside hacker group, the group that provides ransomware as a service\nSource: portswigger.net Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/ezgif.com-gif-maker-2-90x90.jpg New PyScript project lets you run Python programs in the browser1 day ago\n* https://www.blackhatethicalhacking.com/wp-conten[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:42.379178Z"}, {"uuid": "f182efdf-baf4-439a-a268-288f1b7c0e85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22054", "type": "seen", "source": "https://t.me/hacking_Attack/52213", "content": "Black Hat Ethical Hacking\nSecurity bug in VMWare Workspace ONE could allow access to internal, cloud networks\n\nSecurity bug in VMWare Workspace ONE could allow access to internal, cloud networksPost Views: 32 \nPremium Content\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-2.png Subscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nA security vulnerability in a mobile device management software could allow attackers access to organizations\u2019 internal and cloud networks, researchers warn.\nDiscovered by Assetnote, the server-side request forgery\u00a0(SSRF) bug was found in VMWare Workspace One UEM.\n\nTracked as CVE-2021-22054, the vulnerability could risk credentials and other sensitive data falling into the hands of malicious attackers.\n\n\u201cWe discovered a pre-authentication vulnerability that allowed us to make arbitrary HTTP requests, including requests with any HTTP method and request body,\u201d the researchers wrote in a blog post.\n\n\u201cIn order to exploit this SSRF, we had to reverse engineer the encryption algorithm used by VMWare Workspace One UEM.\u201d\n\nThe team were able to breach \u201ca number of\u201d organizations\u00a0using the software, accessing both their internal network and cloud services.\n\nSpeaking to The Daily Swig, Assetnote\u2019s Subham Shah said: \u201cWhile I cannot share exact details about what companies were effected, there were a large number of enterprises that were vulnerable to this.\n\n\u201cIn some cases, it was possible to use this vulnerability to breach the AWS accounts of the companies.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Shah added: \u201cThe impact of this vulnerability is rather on the organization running the software, instead of the individual users that are using the products.\n\u201cUsing the SSRF vulnerability, it is possible to reach arbitrary hosts on the internal network. On cloud\u00a0networks such as AWS, it is possible to reach the metadata IP address and potentially steal security credentials.\n\n\u201cUsing these security credentials, it is possible to escalate the vulnerability to gain access to other infrastructure belonging to a company.\u201d\nSee Also: New Nimbuspwn Linux vulnerability gives hackers root privileges RemediationsThe issue, which was first discovered in November 2021, has since been patched by the vendor.\n\nShah said that while VMware dealt with the issues \u201cin a timely manner\u201d, researchers agreed to the vendor\u2019s request for more time to release more patches and allow customers to patch their instances before disclosure.\n\nAn advisory from VMWare\u00a0contains details of fixes for the software.\n\nShah advised users of mobile management device software \u201cif possible, do not expose the MDM solution to the external internet\u201d. See Also: OSINT Tool: MOSINT Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Darkside hacker group, the group that provides ransomware as a service\nSource: portswigger.net Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/ezgif.com-gif-maker-2-90x90.jpg New PyScript project lets you run Python programs in the browser1 day ago\n* https://www.blackhatethicalhacking.com/wp-conten[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:54.026666Z"}, {"uuid": "bd2dac2c-99ea-4a86-b318-2d0cb6f08076", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22054", "type": "published-proof-of-concept", "source": "Telegram/wM44PB7rs9Na_M_NX9_ZEY8E_RYf0GtNF8Am5ZddqV3Wors", "content": "", "creation_timestamp": "2026-09-03T08:00:04.499341Z"}, {"uuid": "612c2c93-2c74-4e5a-b347-e2ff0c669f21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22054", "type": "published-proof-of-concept", "source": "Telegram/wM44PB7rs9Na_M_NX9_ZEY8E_RYf0GtNF8Am5ZddqV3Wors", "content": "", "creation_timestamp": "2026-09-04T00:00:57.054834Z"}]}