CVE-2022-31663: XSS

Published Aug 5, 2022

Updated

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a reflected cross-site scripting (XSS) vulnerability. Due to improper user input sanitization, a malicious actor with some user interaction may be able to inject javascript code in the target user's window.

Affected Software

14 affected components

VMware Identity Manager=3.3.4

VMware Identity Manager=3.3.5

VMware Identity Manager=3.3.6

VMware ONE Access=21.08.0.0

VMware ONE Access=21.08.0.1

Linux Linux kernel

VMware Access Connector=21.08.0.0

VMware Access Connector=21.08.0.1

VMware Access Connector=22.05

VMware Identity Manager Connector=3.3.4

VMware Identity Manager Connector=3.3.5

VMware Identity Manager Connector=3.3.6

VMware Identity Manager Connector=19.03.0.1

Microsoft Windows

Remediation

Patch Available

https://www.vmware.com/security/advisories/VMSA-2022-0021.html

Event History

Aug 5, 2022

CVE Published

via MITRE·03:06 PM

Data Sourced

via MITRE·03:06 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2022-31663?

CVE-2022-31663 is a reflected cross-site scripting (XSS) vulnerability found in VMware Workspace ONE Access, Identity Manager, and vRealize Automation.

What is the severity of CVE-2022-31663?

The severity of CVE-2022-31663 is medium, with a CVSS score of 6.1.

Which software products are affected by CVE-2022-31663?

VMware Identity Manager versions 3.3.4, 3.3.5, and 3.3.6, VMware One Access versions 21.08.0.0 and 21.08.0.1, and VMware Access Connector versions 21.08.0.0, 21.08.0.1, and 22.05 are affected by CVE-2022-31663.

How does CVE-2022-31663 impact users?

CVE-2022-31663 allows a malicious actor with some user interaction to inject JavaScript code in the target user's window.

Where can I find more information about CVE-2022-31663?

More information about CVE-2022-31663 can be found in the VMware Security Advisory VMSA-2022-0021.