{"id":"CVE-2021-22054","published":"2021-12-17T17:15:12Z","modified":"2026-10-01T19:17:13Z","title":"Omnissa Workspace ONE Server-Side Request Forgery","vendor":"Omnissa","product":"Workspace One UEM","tier":"core","eol":null,"description":{"text":"VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.","provenance":"source","from":"NVD"},"summary":{"text":"A server-side request forgery flaw in the Omnissa Workspace ONE UEM console (versions 20.0.8 before 20.0.8.37, 20.11.0 before 20.11.0.40, 21.2.0 before 21.2.0.27, and 21.5.0 before 21.5.0.37) lets the server be coerced into making requests on an attacker's behalf. An attacker with network access to the UEM console can exploit it without authentication or user interaction to reach sensitive information.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T04:54:39Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.99677,"percentile":0.9995,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2026-03-09","dueDate":"2026-03-23","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://web.archive.org/web/20211222154335/https://www.vmware.com/security/advisories/VMSA-2021-0029.html ; https://nvd.nist.gov/vuln/detail/CVE-2021-22054","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-03-11","exploitedFirstSeen":"2025-03-11","ransomware":false,"evidence":[{"url":"https://www.greynoise.io/blog/new-ssrf-exploitation-surge","date":"2025-03-11"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-03-09"},{"url":"https://tracker.crowdsec.net/cves/CVE-2021-22054","date":"2026-04-08"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-05-15&host_type=src&vulnerability=cve-2021-22054","date":"2026-05-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-17&host_type=src&vulnerability=cve-2021-22054","date":"2026-08-17"}],"evidenceTotal":5,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"}],"references":[{"url":"https://www.vmware.com/security/advisories/VMSA-2021-0029.html","tags":["Patch","Vendor Advisory"]},{"url":"https://www.vmware.com/security/advisories/VMSA-2021-0029.html","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22054","tags":["US Government Resource"]},{"url":"https://www.greynoise.io/blog/new-ssrf-exploitation-surge","tags":["Third Party Advisory"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated network-reachable public-facing console SSRF","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM","start":146,"end":242}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: SSRF yields sensitive data disclosure","mappingType":"primary_impact","evidence":[{"from":"description","quote":"to gain access to sensitive information","start":293,"end":332}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-9219","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-9219","exploited":true,"exploitedSince":"2026-03-09","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2022-06-03","earliestUrl":"https://github.com/MKSx/CVE-2021-22054","repos":[{"name":"MKSx/CVE-2021-22054","url":"https://github.com/MKSx/CVE-2021-22054","stars":5,"created":"2022-06-03"}]},"nuclei":[{"id":"CVE-2021-22054","name":"VMWare Workspace ONE UEM - Server-Side Request Forgery","severity":"high","path":"http/cves/2021/CVE-2021-22054.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22054.yaml"}],"first":{"date":"2022-06-03","source":"PoC-in-GitHub","url":"https://github.com/MKSx/CVE-2021-22054"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1005"],"provenance":"ai"}],"timeline":[{"date":"2021-12-17","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22054","provenance":"source"},{"date":"2022-06-03","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/MKSx/CVE-2021-22054","provenance":"source"},{"date":"2025-03-11","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.greynoise.io/blog/new-ssrf-exploitation-surge","provenance":"source"},{"date":"2026-03-09","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-03-09","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-9219","provenance":"source"}],"speed":{"daysToPublicExploit":168,"firstExploitFrom":"PoC-in-GitHub","daysToKev":1543},"priority":{"score":68.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 599 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9995"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}