VMware Workspace One Access / VMware Identity Manager Multiple Vulnerabilities (VMSA-2022-0011)

The VMware Workspace One Access formerly VMware Identity Manager application running on the remote host is affected by the following vulnerabilities: - Server-side Template Injection Remote Code Execution Vulnerability CVE-2022-22954 - OAuth2 ACS Authentication Bypass Vulnerabilities...

PT-2022-2141

Name of the Vulnerable Software and Affected Versions VMware Workspace ONE Access affected versions not specified VMware Identity Manager affected versions not specified VMware vRealize Automation affected versions not specified Description The issue is related to a cross-site request forgery...

多款 VMware 产品代码问题漏洞

Vmware vRealize Automation and others are products of Vmware, Inc. vRealize Automation is a management tool that provides self-service, supervised multi-cloud automation. vRealize Automation is a management tool that provides self-service, supervised multi-cloud automation. vRealize Automation is...

多款 VMware 产品信息泄露漏洞

Vmware vRealize Automation and others are products of Vmware, Inc. vRealize Automation is a management tool that provides self-service, supervised multi-cloud automation. vRealize Automation is a management tool that provides self-service, supervised multi-cloud automation. vRealize Automation is...

VMware Workspace ONE Access VMSA-2022-0011 exploit chain

This module combines two vulnerabilities in order achieve remote code execution in the context of the horizon user. The first vulnerability CVE-2022-22956 is an authentication bypass in OAuth2TokenResourceController ACS which allows a remote, unauthenticated attacker to bypass the authentication...

Vmware Workspace One Access 授权问题漏洞

Vmware Workspace One Access is Vmware USA's combines user identity with factors such as device and network information to make intelligence-driven conditional access decisions for Workspace One delivered applications. An authorization issue vulnerability exists in Vmware Workspace One Access due ...

PT-2022-2144

Name of the Vulnerable Software and Affected Versions VMware Workspace One Access affected versions not specified Description The issue is related to weaknesses in the OAuth2 ACS authentication procedure of the VMware Workspace One Access administration platform. It allows a remote attacker to...

多款 VMware 产品授权问题漏洞

Vmware vRealize Automation and others are products of Vmware, Inc. vRealize Automation is a management tool that provides self-service, supervised multi-cloud automation. vRealize Automation is a management tool that provides self-service, supervised multi-cloud automation. vRealize Automation is...

VulnCheck KEV: CVE-2022-22960

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts...

VMware Workspace ONE Access CVE-2022-22960

This module exploits CVE-2022-22960 which allows the user to overwrite the permissions of the certproxyService.sh script so that it can be modified by the horizon user. This allows a local attacker with the uid 1001 to escalate their privileges to root access. Module Options msf use...

PT-2022-2142 · Vmware · Vmware Vrealize Automation +4

Name of the Vulnerable Software and Affected Versions: VMware Workspace ONE Access versions affected versions not specified VMware Cloud Foundation versions affected versions not specified VMware vRealize Automation versions affected versions not specified vRealize Suite Lifecycle Manager version...

多款 VMware 产品安全漏洞

Vmware vRealize Automation and others are products of Vmware, Inc. vRealize Automation is a management tool that provides self-service, supervised multi-cloud automation. vRealize Automation is a management tool that provides self-service, supervised multi-cloud automation. vRealize Automation is...

VMware Workspace ONE Access CVE-2022-22954

This module exploits CVE-2022-22954, an unauthenticated server-side template injection SSTI in VMware Workspace ONE Access, to execute shell commands as the "horizon" user. Module Options msf use exploit/linux/http/vmware/workspaceoneaccesscve202222954 msf undefinedworkspaceoneaccesscve202222954...

VulnCheck KEV: CVE-2022-22954

VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection...

VMSA-2022-0011:VMware Workspace ONE Access, Identity Manager and vRealize Automation updates address multiple vulnerabilities

Advisory ID:VMSA-2022-0011.2 CVSSv3 Range:5.3-9.8 Issue Date:2022-04-06 Updated On:2022-04-13 CVEs:CVE-2022-22954, CVE-2022-22955,CVE-2022-22956, CVE-2022-22957, CVE-2022-22958, CVE-2022-22959, CVE-2022-22960, CVE-2022-22961 Synopsis:VMware Workspace ONE Access, Identity Manager and vRealize...

PT-2022-2143 · Vmware · Vmware Workspace One Access

Name of the Vulnerable Software and Affected Versions: VMware Workspace One Access affected versions not specified Description: The issue is related to the OAuth2 ACS service of the application administration platform, which has weaknesses in its authentication procedure. This can be exploited by...

SRC-2022-0007 : VMware Workspace ONE Access OAuth2ActivateResource ACS Authentication Bypass Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to bypass authentication on affected installations of VMware Workspace ONE Access. Authentication is not required to exploit this vulnerability. The specific flaw exists within OAuth2ActivateResource class. The issue results from t...

SRC-2022-0010 : VMware Workspace ONE Access DBConnectionCheckController Cross-Site Request Forgery Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on affected installations of VMware Workspace ONE Access. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific fl...

SRC-2022-0005 : VMware Workspace ONE Access customError.ftl Server-side Template Injection Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on affected installations of VMware Workspace ONE Access. Authentication is not required to exploit this vulnerability. The specific flaw exists within the customError.ftl template. The issue results from...

SRC-2022-0011 : VMware Workspace ONE Access gatherConfig.hzn Privilege Escalation Vulnerability

Vulnerability Details: This vulnerability allows local attackers to escalate privileges on affected installations of VMware Workspace ONE Access. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw...