Blackberry Workspaces Server vulnerabilities

3 CVEs affecting Blackberry Workspaces Server, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-22155, published 2021-05-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-1938: Apache Tomcat Improper Privilege Management Vulnerability, published 2020-02-24. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 99.3% chance of exploitation in the next 30 days. When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar…
CVE-2020-11652: SaltStack Salt Path Traversal Vulnerability, published 2020-04-30. Medium severity, CVSS 6.5. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 86.2% chance of exploitation in the next 30 days. An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods…
CVE-2021-22155, published 2021-05-13. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. An Authentication Bypass vulnerability in the SAML Authentication component of BlackBerry Workspaces Server (deployed with Appliance-X) version(s) 10.1, 9.1 and earlier could allow an attacker to…