VMware Releases Security Updates 3 August 2022

By /
  • 169/2022
  • Critical

VMware has released a security advisory to address critical vulnerabilities which affect multiple VMware products. The remote attacker could exploit some of these vulnerabilities to take control of the affected system.

The addressed vulnerabilities could allow the attackers to perform several attacks like bypassing security restrictions, redirecting a victim to arbitrary websites, directory traversal, cross-site scripting, elevating privileges to root on the affected system, and executing arbitrary code leading to complete compromise of the vulnerable system.


The affected products:

  • VMware Workspace ONE Access (Access)
  • VMware Workspace ONE Access Connector (Access Connector)
  • VMware Identity Manager (vIDM)
  • VMware Identity Manager Connector (vIDM Connector)
  • VMware vRealize Automation (vRA)
  • VMware Cloud Foundation
  • vRealize Suite Lifecycle Manager

Samples of the addressed vulnerabilities:

  1. VMware Workspace ONE Access, Identity Manager, and vRealize Automation security bypass (CVE-2022-31656):
    • CVSS: 9.8
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Consequences: Bypass Security

  2.  VMware Workspace ONE Access, Identity Manager, and vRealize Automation code execution (CVE-2022-31659):
    • CVSS: 8
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: High
    • User Interaction: None
    • Consequences: Gain Access
Vulnerabilities
  • CVE-2022-31656
  • CVE-2022-31657
  • CVE-2022-31658
  • CVE-2022-31659
  • CVE-2022-31660
  • CVE-2022-31661
  • CVE-2022-31662
  • CVE-2022-31663
  • CVE-2022-31664
  • CVE-2022-31665
Mitigations

The enterprise should deploy this patch as soon as the testing phase is completed.

https://www.vmware.com/security/advisories/VMSA-2022-0021.html

References

https://www.vmware.com/security/advisories/VMSA-2022-0021.html