by Kastro
Paper/Archive/CVE-2022-31687

CVE-2022-31687

vmware — VMware Workspace ONE Assist prior to 22.10 contains a Broken Access Control vulnerability.

EPSS 0.9%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 60.2.602 × 2012.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

VMware Workspace ONE Assist prior to 22.10 contains a Broken Access Control vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application.

Affected

ProductAffectedFixed inSource
VMware Workspace ONE AssistVMware Workspace ONE Assist prior to 22.10–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refvmware.com/security/advisories/VMSA-2022-0028.html