by Kastro
Paper/Archive/CVE-2022-31686

CVE-2022-31686

vmware — VMware Workspace ONE Assist prior to 22.10 contains a Broken Authentication Method vulnerability.

EPSS 1%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 63.1.631 × 2012.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

VMware Workspace ONE Assist prior to 22.10 contains a Broken Authentication Method vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application.

Affected

ProductAffectedFixed inSource
VMware Workspace ONE AssistVMware Workspace ONE Assist prior to 22.10–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refvmware.com/security/advisories/VMSA-2022-0028.html