CVE-2018-6968 Code injection in AirWatch Agent

What is CVE-2018-6968?

CVE-2018-6968 is a critical code injection vulnerability in VMware AirWatch Agent, published on 11 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The VMware AirWatch Agent for Android prior to 8.2 and AirWatch Agent for Windows Mobile prior to 6.5.2 contain a remote code execution vulnerability in real time File Manager capabilities. This vulnerability may allow for unauthorized creation and execution of files in the Agent sandbox and other publicly accessible directories such as those on the SD card by a malicious administrator.

Which versions are affected by CVE-2018-6968?

It affects 1 product.

Products include Vmware Airwatch Agent.

How do I fix CVE-2018-6968?

No fix has been published for CVE-2018-6968 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2018-6968 being exploited?

There is no known exploitation of CVE-2018-6968 in the wild and no public exploit code.

Other vulnerabilities in VMware AirWatch Agent

• CVE-2017-4895 Security feature bypass in Airwatch Agent High 8.8
• CVE-2017-4896 Information disclosure in Airwatch Console Low 3.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pf3f-28gw-f274.