CVE-2022-31658: High severity vmware workspace one access and identity manager vulnerability

Published Aug 5, 2022

Updated

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. A malicious actor with administrator and network access can trigger a remote code execution.

Affected Software

14 affected components

VMware Identity Manager=3.3.4

VMware Identity Manager=3.3.5

VMware Identity Manager=3.3.6

VMware ONE Access=21.08.0.0

VMware ONE Access=21.08.0.1

Linux Linux kernel

VMware Access Connector=21.08.0.0

VMware Access Connector=21.08.0.1

VMware Access Connector=22.05

VMware Identity Manager Connector=3.3.4

VMware Identity Manager Connector=3.3.5

VMware Identity Manager Connector=3.3.6

VMware Identity Manager Connector=19.03.0.1

Microsoft Windows

Remediation

Patch Available

https://www.vmware.com/security/advisories/VMSA-2022-0021.html

Event History

Aug 5, 2022

CVE Published

via MITRE·03:07 PM

Data Sourced

via MITRE·03:07 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2022-31658?

CVE-2022-31658 has been classified with a high severity due to its potential for remote code execution.

How do I fix CVE-2022-31658?

To fix CVE-2022-31658, update to the latest patched versions of VMware Workspace ONE Access or VMware Identity Manager as recommended by VMware.

What systems are affected by CVE-2022-31658?

CVE-2022-31658 affects specific versions of VMware Workspace ONE Access, VMware Identity Manager, and VMware Identity Manager Connector.

What type of vulnerability is CVE-2022-31658?

CVE-2022-31658 is classified as a remote code execution vulnerability that can be exploited by malicious actors.

Who can exploit CVE-2022-31658?

CVE-2022-31658 can be exploited by a malicious actor with administrator and network access to the vulnerable systems.