- 305/2022
- Critical
VMware has released security updates to fix vulnerabilities across multiple products.
severity of the addressed vulnerabilities could allow the remote attacker to execute arbitrary commands via specially crafted requests to gain access and obtain information from the affected products.
Sample of the addressed vulnerabilities:
1. VMware vRealize Network Insight command execution (CVE-2022-31702)
• CVSS: 9.8
• Attack Vector: Network
• Attack Complexity: low
• Privileges Required: None
• User Interaction: None
• Consequences: Gain Access
2. VMware vRealize Network Insight directory traversal (CVE-2022-31703)
• CVSS: 7.5
• Attack Vector: Network
• Attack Complexity: low
• Privileges Required: None
• User Interaction: None
• Consequences: Obtain Information
Affected Products:
• VMware vRealize Network Insight (vRNI)
• VMware Workspace ONE Access (Access)
• VMware Identity Manager (vIDM)
• VMware Cloud Foundation (Cloud Foundation)
Vulnerabilities
- CVE-2022-31700
- CVE-2022-31701
- CVE-2022-31702
- CVE-2022-31703
Mitigations
The enterprise should deploy this patch as soon as the testing phase is completed.