CVE-2022-22961

—

CVSS 3.1

5.3 medium

EPSS

<1%p56

Published

Apr 13, 2022 (Apr 13, 2022)

Modified

Jun 17, 2026

Description

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an information disclosure vulnerability due to returning excess information. A malicious actor with remote access may leak the hostname of the target system. Successful exploitation of this issue can lead to targeting victims.

Vendors: vmware
Products: cloud foundation, identity manager, vrealize automation, vrealize suite lifecycle manager, workspace one access
Weakness: CWE-200
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.8%)

In the news3 stories

Threat Brief: VMware Vulnerabilities Exploited in the Wild (CVE-2022

Palo Alto Unit 42Jun 5, 20:43 UTC · Jun 5, 2024Exploit / PoC in the wildCVE-2022-22954 CVE-2022-22960 CVE-2022-22972+8 CVEs

VMware addressed several critical vulnerabilities in multiple products

Security AffairsApr 7, 07:10 UTC · Apr 7, 2022Vulnerability CVE-2022-22954 CVE-2022-22955 CVE-2022-22956+5 CVEs

VMware Releases Critical Patches for New Vulnerabilities Affecting Multiple Products

The Hacker NewsApr 7, 05:49 UTC · Apr 7, 2022Vulnerability in the wildCVE-2022-22954 CVE-2022-22961 CVE-2022-22955+5 CVEs