Improper access control in AirWatch Console - CVE-2017-4931

Vulnerability identifier: #VU9174

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N]

CVE-ID: CVE-2017-4931

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote authenticated attacker to modify log files on the target system.

The weakness exists due to a flaw in the AirWatch Console. A remote attacker can add data to the target enrolled device's CSV log files.

AirWatch Console
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Desktop Applications Module
openSUSE Leap
mutter
mutter-debuginfo
mutter-devel
mutter-debugsource
mutter-lang

Update to version AirWatch Console 9.2.0.

mutter - update to 45.3-150600.5.9.1
mutter-debuginfo - update to 45.3-150600.5.9.1
mutter-devel - update to 45.3-150600.5.9.1
mutter-debugsource - update to 45.3-150600.5.9.1
mutter-lang - update to 45.3-150600.5.9.1

• http://www.vmware.com/security/advisories/VMSA-2017-0016.html

• Multiple vulnerabilities in VMware AirWatch
• SUSE update for Recommended update for mutter