CVE-2023-20884

VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. An unauthenticated malicious actor may be able to redirect a victim to an attacker controlled domain due to improper path handling leading to sensitive information disclosure...

CVE-2023-20884

VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. An unauthenticated malicious actor may be able to redirect a victim to an attacker controlled domain due to improper path handling leading to sensitive information disclosure...

Design/Logic Flaw

VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. An unauthenticated malicious actor may be able to redirect a victim to an attacker controlled domain due to improper path handling leading to sensitive information disclosure...

CVE-2023-20884

CVE-2023-20884 affects VMware Workspace ONE Access and VMware Identity Manager. The issue is an insecure redirect caused by improper path handling that could allow an unauthenticated attacker to redirect victims to attacker-controlled domains, potentially disclosing sensitive information. VMware ...

VMware Identity Manager 输入验证错误漏洞

VMware Identity Manager is a Workspace One identity and access management component from VMware, Inc. A security vulnerability exists in VMware Workspace ONE Access and VMware Identity Manager, which stems from a mishandling of paths leading to the disclosure of sensitive information...

PT-2023-3027 · Vmware · Vmware Workspace One Access +1

Name of the Vulnerable Software and Affected Versions: VMware Workspace One Access and VMware Identity Manager affected versions not specified Description: The issue is related to improper neutralization of special elements in output, which can be exploited by a remote attacker to redirect users ...

VMSA-2023-0011:VMware Workspace ONE Access and Identity Manager update addresses an Insecure Redirect Vulnerability.

Advisory ID: VMSA-2023-0011 CVSSv3 Range: 6.1 Issue Date:2023-05-30 Updated On: 2023-05-30 Initial Advisory CVEs: CVE-2023-20884 Synopsis: VMware Workspace ONE Access and Identity Manager update addresses an Insecure Redirect Vulnerability. CVE-2023-20884 RSS Feed Download PDF Download Text File...

Metasploit Weekly Wrap-Up

VMware Workspace ONE Access exploit chain A new module contributed by jheysel-r7 exploits two vulnerabilities in VMware Workspace ONE Access to attain Remote Code Execution as the horizon user. First being CVE-2022-22956, which is an authentication bypass and the second being a JDBC injection in...

VMware Workspace ONE Access CVE-2022-22960

This module exploits CVE-2022-22960 which allows the user to overwrite the permissions of the certproxyService.sh script so that it can be modified by the horizon user. This allows a local attacker with the uid 1001 to escalate their privileges to root access. Module Options msf use...

VMware Workspace ONE Access Privilege Escalation Exploit

This Metasploit module exploits CVE-2022-22960 which allows the user to overwrite the permissions of the certproxyService.sh script so that it can be modified by the horizon user. This allows a local attacker with the uid 1001 to escalate their privileges to root access. This module requires...

VMware Workspace ONE Access Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VMware Workspace ONE Access CVE-2022-22960', 'Description' = %q This module exploits CVE-2022-22960 which allows the user to overwrite the...

VMware Workspace ONE Access VMSA-2022-0011 exploit chain

This module combines two vulnerabilities in order achieve remote code execution in the context of the horizon user. The first vulnerability CVE-2022-22956 is an authentication bypass in OAuth2TokenResourceController ACS which allows a remote, unauthenticated attacker to bypass the authentication...

CVE-2022-31701

VMware Workspace ONE Access and Identity Manager contain a broken authentication vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.3...

CVE-2022-31700

VMware Workspace ONE Access and Identity Manager contain an authenticated remote code execution vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.2...

Vulnerabilities fixed in several VMware products

VMWare has fixed several vulnerabilities in its products: VMware Workspace ONE Access and Identity Manager, VMware ESXi, VMware Workstation Pro / Player, VMware Fusion Pro / Fusion, VMware Cloud Foundation and VMware vRealize Impact A malicious party could potentially exploit the vulnerabilities ...

PT-2022-20896 · Vmware · Vmware Workspace One Access +1

Name of the Vulnerable Software and Affected Versions: VMware Workspace ONE Access and Identity Manager affected versions not specified Description: The issue is related to a broken authentication vulnerability. It is estimated to be of moderate severity. There is no information provided about th...

PT-2022-20895 · Vmware · Vmware Workspace One Access +1

Name of the Vulnerable Software and Affected Versions: VMware Workspace ONE Access and Identity Manager affected versions not specified Description: The issue is an authenticated remote code execution vulnerability. It has been evaluated to be in the Important severity range. The vulnerability ca...

CVE-2022-31701

CVE-2022-31701 affects VMware Workspace ONE Access and VMware Identity Manager. The Red Hat/VMware/NVD and VMSA details confirm a broken authentication vulnerability exploitable via a network path, with a CVSSv3 base score of 5.3 (Moderate); affected components are the authentication endpoints wh...

SRC-2022-0023 : VMWare Workspace ONE Access ClaimTransformationHelper validateClaimRuleCondition Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to disclose sensitive information on affected installations of VMWare Workspace ONE Access. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...

VMware Workspace ONE Access CVE-2022-31660

VMware Workspace ONE Access contains a vulnerability whereby the horizon user can escalate their privileges to those of the root user by modifying a file and then restarting the vmware-certproxy service which invokes it. The service control is permitted via the sudo configuration without a...