by Kastro
Paper/Archive/CVE-2022-22954

CVE-2022-22954

VMware Workspace ONE Access and Identity Manager — VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability

KEV · due 5 Mayransomware useEPSS 100%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (ADP)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 100.01.000 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.

Affected

ProductAffectedFixed inSource
VMware Workspace ONE Access and Identity ManagerAccess 21.08.0.1, 21.08.0.0, 20.10.0.1, 20.10.0.0. Identity Manager 3.3.6, 3.3.5, 3.3.4, 3.3.3.–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refvmware.com/security/advisories/VMSA-2022-0011.htmlrefpacketstormsecurity.com/files/166935/VMware-Workspace-ONE-Access-Template-Injection-Command-Execution.htmlrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22954kevcisa.gov/known-exploited-vulnerabilities-catalog