CVE-2022-31689

—

CVSS 3.1

9.8 critical

EPSS

<1%p57

Published

Nov 9, 2022 (Nov 9, 2022)

Modified

Jun 17, 2026

Description

VMware Workspace ONE Assist prior to 22.10 contains a Session fixation vulnerability. A malicious actor who obtains a valid session token may be able to authenticate to the application using that token.

Vendors: vmware
Products: workspace one assist
Weakness: CWE-384
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news2 stories

VMware Warns of 3 New Critical Flaws Affecting Workspace ONE Assist Software

The Hacker NewsNov 9, 13:11 UTC · Nov 9, 2022Vulnerability CVE-2022-31685 CVE-2022-31686 CVE-2022-31687+2 CVEs

VMware fixes three critical flaws in Workspace ONE Assist

Security AffairsNov 9, 08:47 UTC · Nov 9, 2022Vulnerability CVE-2022-31685 CVE-2022-31686 CVE-2022-31687+2 CVEs