CVE-2014-8372

Vulnerability

AirWatch by VMware On-Premise versions 7.3.x.x prior to 7.3.3.0 (FP3) contain a direct object reference vulnerability in the multi-tenant environment. This allows a user who manages an AirWatch deployment to access organizational information and statistics belonging to other tenants by manipulating object references. The issue affects only On-Premise deployments; AirWatch Cloud is not vulnerable [1].

Exploitation

An attacker must be a remote authenticated user with access to an AirWatch On-Premise instance in a multi-tenant configuration. By crafting requests that modify direct object references (e.g., tenant IDs or resource identifiers), the attacker can retrieve data from arbitrary tenants without proper authorization checks. No additional privileges or user interaction beyond authentication are required [1].

Impact

Successful exploitation results in unauthorized disclosure of organizational information and statistics from other tenants. This includes sensitive data such as device counts, user details, and configuration metrics. The attacker gains read access to cross-tenant data but does not achieve code execution or privilege escalation within the compromised tenant [1].

Mitigation

VMware released AirWatch On-Premise 7.3.3.0 (FP3) to address this vulnerability. All On-Premise deployments should be updated to this version or later. AirWatch Cloud was already patched and requires no action. No workarounds are documented; the only mitigation is applying the update [1].