7.2
CVE-2022-22957
- EPSS 23.08%
- Veröffentlicht 13.04.2022 18:15:13
- Zuletzt bearbeitet 21.11.2024 06:47:41
- Erkennungen
LoginVMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A malicious actor with administrative access can trigger deserialization of untrusted data through malicious JDBC URI which may result in remote code execution.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
VMware ≫ Cloud Foundation Version >= 3.0 < 5.0
VMware ≫ Identity Manager Version 3.3.3
VMware ≫ Identity Manager Version 3.3.4
VMware ≫ Identity Manager Version 3.3.5
VMware ≫ Identity Manager Version 3.3.6
VMware ≫ Vrealize Automation Version >= 8.0 < 9.0
VMware ≫ Vrealize Automation Version 7.6
VMware ≫ Vrealize Suite Lifecycle Manager Version >= 8.0 < 9.0
VMware ≫ Workspace One Access Version 20.10.0.0
VMware ≫ Workspace One Access Version 20.10.0.1
VMware ≫ Workspace One Access Version 21.08.0.0
VMware ≫ Workspace One Access Version 21.08.0.1
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 23.08% | 0.975 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 7.2 | 1.2 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
|
| NIST | 6.5 | 8 | 6.4 |
AV:N/AC:L/Au:S/C:P/I:P/A:P
|
CWE-502 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
https://www.vmware.com/security/advisories/VMSA-2022-0011.html
http://packetstormsecurity.com/files/171918/Mware-Workspace-ONE-Remote-Code-Execution.html
http://packetstormsecurity.com/files/171918/VMware-Workspace-ONE-Remote-Code-Execution.html