VMware Releases Critical Patches for New Vulnerabilities Affecting Multiple Products

VMware has produced security updates to patch 8 vulnerabilities spanning its products, some of which could be exploited to start distant code execution attacks.

Tracked from CVE-2022-22954 to CVE-2022-22961 (CVSS scores: 5.3 – 9.8), the issues influence VMware Workspace Just one Access, VMware Id Manager, VMware vRealize Automation, VMware Cloud Foundation, and vRealize Suite Lifecycle Manager.

Five of the 8 bugs are rated Critical, two are rated Significant, and just one is rated Reasonable in severity. Credited with reporting all the vulnerabilities is Steven Seeley of Qihoo 360 Vulnerability Investigation Institute.

The checklist of flaws is underneath –

• CVE-2022-22954 (CVSS rating: 9.8) – Server-side template injection remote code execution vulnerability influencing VMware Workspace A person Accessibility and Identity Supervisor
• CVE-2022-22955 & CVE-2022-22956 (CVSS scores: 9.8) – OAuth2 ACS authentication bypass vulnerabilities in VMware Workspace A single Access
• CVE-2022-22957 & CVE-2022-22958 (CVSS scores: 9.1) – JDBC injection remote code execution vulnerabilities in VMware Workspace One Entry, Identity Manager, and vRealize Automation
• CVE-2022-22959 (CVSS rating: 8.8) – Cross-web-site ask for forgery (CSRF) vulnerability in VMware Workspace A person Accessibility, Identity Supervisor, and vRealize Automation
• CVE-2022-22960 (CVSS rating: 7.8) – Neighborhood privilege escalation vulnerability in VMware Workspace Just one Access, Identification Manager and vRealize Automation, and
• CVE-2022-22961 (CVSS rating: 5.3) – Details disclosure vulnerability impacting VMware Workspace Just one Accessibility, Id Manager and vRealize Automation

Productive exploitation of the aforementioned weaknesses could permit a destructive actor to escalate privileges to root user, gain access to the hostnames of the goal methods, and remotely execute arbitrary code, effectively making it possible for entire takeover.

“This critical vulnerability need to be patched or mitigated quickly,” VMware reported in an notify. “The ramifications of this vulnerability are severe.”

While the virtualization companies supplier mentioned that it has not found any proof that the vulnerabilities have been exploited in the wild, it’s really encouraged to apply the patches to get rid of opportunity threats.

“Workarounds, while hassle-free, do not clear away the vulnerabilities, and may perhaps introduce more complexities that patching would not,” the organization cautioned.

Located this post appealing? Observe THN on Facebook, Twitter  and LinkedIn to browse additional special material we article.

Some sections of this report are sourced from:
thehackernews.com