Vulnerability Description
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A malicious actor with administrative access can trigger deserialization of untrusted data through malicious JDBC URI which may result in remote code execution.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Vmware | Cloud Foundation | >= 3.0, < 5.0 |
| Vmware | Identity Manager | 3.3.3 |
| Vmware | Vrealize Automation | >= 8.0, < 9.0 |
| Vmware | Vrealize Suite Lifecycle Manager | >= 8.0, < 9.0 |
| Vmware | Workspace One Access | 20.10.0.0 |
| Linux | Linux Kernel | - |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/171918/Mware-Workspace-ONE-Remote-Code-Exec
- http://packetstormsecurity.com/files/171918/VMware-Workspace-ONE-Remote-Code-Exe
- https://www.vmware.com/security/advisories/VMSA-2022-0011.htmlPatchVendor Advisory
- http://packetstormsecurity.com/files/171918/Mware-Workspace-ONE-Remote-Code-Exec
- http://packetstormsecurity.com/files/171918/VMware-Workspace-ONE-Remote-Code-Exe
- https://www.vmware.com/security/advisories/VMSA-2022-0011.htmlPatchVendor Advisory
FAQ
What is CVE-2022-22957?
CVE-2022-22957 is a vulnerability with a CVSS score of 7.2 (HIGH). VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A malicious actor with administrative access ...
How severe is CVE-2022-22957?
CVE-2022-22957 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-22957?
Check the references section above for vendor advisories and patch information. Affected products include: Vmware Cloud Foundation, Vmware Identity Manager, Vmware Vrealize Automation, Vmware Vrealize Suite Lifecycle Manager, Vmware Workspace One Access.