{"id":"CVE-2021-22054","published":"2021-12-17T17:15:12Z","modified":"2026-10-01T19:17:13Z","title":"Omnissa Workspace ONE Server-Side Request Forgery","vendor":"Omnissa","product":"Workspace One UEM","tier":"core","eol":null,"description":{"text":"VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.","provenance":"source","from":"NVD"},"summary":{"text":"A server-side request forgery flaw in the Omnissa Workspace ONE UEM console (versions 20.0.8 before 20.0.8.37, 20.11.0 before 20.11.0.40, 21.2.0 before 21.2.0.27, and 21.5.0 before 21.5.0.37) lets the server be coerced into making requests on an attacker's behalf. An attacker with network access to the UEM console can exploit it without authentication or user interaction to reach sensitive information.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T04:54:39Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.99677,"percentile":0.9995,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2026-03-09","dueDate":"2026-03-23","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://web.archive.org/web/20211222154335/https://www.vmware.com/security/advisories/VMSA-2021-0029.html ; https://nvd.nist.gov/vuln/detail/CVE-2021-22054","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-03-11","exploitedFirstSeen":"2025-03-11","ransomware":false,"evidence":[{"url":"https://www.greynoise.io/blog/new-ssrf-exploitation-surge","date":"2025-03-11"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-03-09"},{"url":"https://tracker.crowdsec.net/cves/CVE-2021-22054","date":"2026-04-08"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-05-15&host_type=src&vulnerability=cve-2021-22054","date":"2026-05-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-17&host_type=src&vulnerability=cve-2021-22054","date":"2026-08-17"}],"evidenceTotal":5,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"}],"references":[{"url":"https://www.vmware.com/security/advisories/VMSA-2021-0029.html","tags":["Patch","Vendor Advisory"]},{"url":"https://www.vmware.com/security/advisories/VMSA-2021-0029.html","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22054","tags":["US Government Resource"]},{"url":"https://www.greynoise.io/blog/new-ssrf-exploitation-surge","tags":["Third Party Advisory"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated network-reachable public-facing console SSRF","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM","start":146,"end":242}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: SSRF yields sensitive data disclosure","mappingType":"primary_impact","evidence":[{"from":"description","quote":"to gain access to sensitive information","start":293,"end":332}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-9219","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-9219","exploited":true,"exploitedSince":"2026-03-09","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2022-06-03","earliestUrl":"https://github.com/MKSx/CVE-2021-22054","repos":[{"name":"MKSx/CVE-2021-22054","url":"https://github.com/MKSx/CVE-2021-22054","stars":5,"created":"2022-06-03"}]},"nuclei":[{"id":"CVE-2021-22054","name":"VMWare Workspace ONE UEM - Server-Side Request Forgery","severity":"high","path":"http/cves/2021/CVE-2021-22054.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22054.yaml"}],"first":{"date":"2022-06-03","source":"PoC-in-GitHub","url":"https://github.com/MKSx/CVE-2021-22054"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1005"],"provenance":"ai"}],"timeline":[{"date":"2021-12-17","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22054","provenance":"source"},{"date":"2022-06-03","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/MKSx/CVE-2021-22054","provenance":"source"},{"date":"2025-03-11","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.greynoise.io/blog/new-ssrf-exploitation-surge","provenance":"source"},{"date":"2026-03-09","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-03-09","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-9219","provenance":"source"}],"speed":{"daysToPublicExploit":168,"firstExploitFrom":"PoC-in-GitHub","daysToKev":1543},"priority":{"score":65.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 600 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9995"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}