CVE-2022-31688

—

CVSS 3.1

6.1 medium

EPSS

<1%p39

Published

Nov 9, 2022 (Nov 9, 2022)

Modified

Jun 17, 2026

Description

VMware Workspace ONE Assist prior to 22.10 contains a Reflected cross-site scripting (XSS) vulnerability. Due to improper user input sanitization, a malicious actor with some user interaction may be able to inject javascript code in the target user's window.

Vendors: vmware
Products: workspace one assist
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news2 stories

VMware Warns of 3 New Critical Flaws Affecting Workspace ONE Assist Software

The Hacker NewsNov 9, 13:11 UTC · Nov 9, 2022Vulnerability CVE-2022-31685 CVE-2022-31686 CVE-2022-31687+2 CVEs

VMware fixes three critical flaws in Workspace ONE Assist

Security AffairsNov 9, 08:47 UTC · Nov 9, 2022Vulnerability CVE-2022-31685 CVE-2022-31686 CVE-2022-31687+2 CVEs