Vulnerabilitycritical
VMware addressed several critical vulnerabilities in multiple products
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-22954 | Server-Side Template Injection RCE in VMware Workspace ONE Access and Identity Manager | 9.8 | 100% | KEVRansomwarePoC | KEV |
CVE-2022-22956+1 related CVE | VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework | 9.8 | 50% | ||
CVE-2022-22957+3 related CVEs | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958) | 7.2 group max | 24% | ||
| CVE-2022-22960 | Local Privilege Escalation in VMware Workspace ONE Access, Identity Manager and vRA | 7.8 | 36% | KEVPoC ×3 | KEV |
From the original article
2 min read at securityaffairs.comVMware fixed critical vulnerabilities in multiple products that could be exploited by remote attackers to execute arbitrary code. VMware has addressed critical remote code vulnerabilities in multiple products , including VMware’s Workspace ONE Access, VMware Identity Manager (vIDM), vRealize Lifecycle Manager, vRealize Automation, and VMware Cloud Foundation products.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.