CVE-2022-22956
First published: Wed Apr 13 2022(Updated: )
VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may bypass the authentication mechanism and execute any operation due to exposed endpoints in the authentication framework.
Credit: security@vmware.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| VMware Identity Manager | =3.3.3 | |
| VMware Identity Manager | =3.3.4 | |
| VMware Identity Manager | =3.3.5 | |
| VMware Identity Manager | =3.3.6 | |
| VMware vRealize Automation | >=8.0<9.0 | |
| VMware vRealize Automation | =7.6 | |
| VMware Workspace ONE Access | =20.10.0.0 | |
| VMware Workspace ONE Access | =20.10.0.1 | |
| VMware Workspace ONE Access | =21.08.0.0 | |
| VMware Workspace ONE Access | =21.08.0.1 | |
| Linux Linux kernel |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-22956?
CVE-2022-22956 is a vulnerability in VMware Workspace ONE Access that allows for authentication bypass.
What is the severity of CVE-2022-22956?
CVE-2022-22956 has a severity score of 9.8, which is considered critical.
Which software versions are affected by CVE-2022-22956?
CVE-2022-22956 affects VMware Identity Manager versions 3.3.3, 3.3.4, 3.3.5, and 3.3.6, as well as VMware Workspace ONE Access versions 20.10.0.0, 20.10.0.1, 21.08.0.0, and 21.08.0.1.
How can the authentication bypass vulnerability in CVE-2022-22956 be exploited?
A malicious actor can exploit the authentication bypass vulnerability in CVE-2022-22956 by bypassing the authentication mechanism and executing any operation due to exposed endpoints in the authentication framework.
Are there any references available for CVE-2022-22956?
Yes, you can find references for CVE-2022-22956 at the following links: http://packetstormsecurity.com/files/171918/Mware-Workspace-ONE-Remote-Code-Execution.html, http://packetstormsecurity.com/files/171918/VMware-Workspace-ONE-Remote-Code-Execution.html, and https://www.vmware.com/security/advisories/VMSA-2022-0011.html.
- collector/nvd-index
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/tags
- agent/type
- agent/event
- agent/description
- agent/remedy
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/vmware
- canonical/vmware identity manager
- version/vmware identity manager/3.3.3
- version/vmware identity manager/3.3.4
- version/vmware identity manager/3.3.5
- version/vmware identity manager/3.3.6
- canonical/vmware vrealize automation
- version/vmware vrealize automation/8.0
- version/vmware vrealize automation/7.6
- canonical/vmware workspace one access
- version/vmware workspace one access/20.10.0.0
- version/vmware workspace one access/20.10.0.1
- version/vmware workspace one access/21.08.0.0
- version/vmware workspace one access/21.08.0.1
- vendor/linux
- canonical/linux linux kernel