by Kastro
Paper/Archive/CVE-2022-31657

CVE-2022-31657

vmware — VMware Workspace ONE Access and Identity Manager contain a URL injection vulnerability.

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 71.3.713 × 2014.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

VMware Workspace ONE Access and Identity Manager contain a URL injection vulnerability. A malicious actor with network access may be able to redirect an authenticated user to an arbitrary domain.

Affected

ProductAffectedFixed inSource
VMware Workspace ONE Access, Identity Manager and vRealize AutomationWorkspace One Access (21.08.0.1 & 21.08.0.0), Identity Manager (vIDM) (3.3.6, 3.3.5 & 3.3.4), and vRealize Automation 7.6–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refvmware.com/security/advisories/VMSA-2022-0021.html