www.vmware.com
Open in
urlscan Pro
2a02:26f0:1700:383::2ef
Public Scan
URL:
https://www.vmware.com/security/advisories/VMSA-2022-0011.html
Submission: On May 24 via api from DE — Scanned from DE
Submission: On May 24 via api from DE — Scanned from DE
Form analysis 2 forms found in the DOM
//www.vmware.com/search.html
<form action="//www.vmware.com/search.html" id="globalsearch" class="wrapperSearch">
<input type="text" name="q" id="ub-search" class="d-none" aria-role="searchbox" role="searchbox">
<a href="javascript:void(0);" aria-label="Search vmware.com" class="search-icon ml-lg-3" name="nav_utility : Search">
<i class="fa fa-search text-indigo mr-2 mr-lg-0" aria-hidden="true"></i>
</a>
<input type="hidden" name="num" value="20">
<input type="hidden" name="filter" value="0">
<input type="hidden" name="ie" value="UTF-8">
<input type="hidden" name="oe" value="UTF-8">
<input type="hidden" name="entqr" value="0">
<input type="hidden" name="start" value="0">
<input type="hidden" name="sort" value="">
<input type="hidden" name="tlen" value="200">
<input type="hidden" name="numgm" value="3">
<input type="hidden" name="cn" value="vmware">
<input type="hidden" name="cid" value="">
<input type="hidden" name="tid" value="">
<input type="hidden" name="getfields" value="*">
<input type="hidden" name="partialfields" value="">
<input type="hidden" name="requiredfields" value="">
<input type="hidden" name="place" value="top">
<input type="hidden" name="client" value="VMware_Site_1">
<input type="hidden" name="site" value="VMware_Site_1">
<input type="hidden" name="cc" value="en">
<input type="hidden" name="stype" value="main">
</form>Name: securitysignup — POST https://lists.vmware.com/mailman/subscribe/security-announce
<form accept-charset="UNKNOWN" action="https://lists.vmware.com/mailman/subscribe/security-announce" enctype="application/x-www-form-urlencoded" id="securitysignup" method="post" name="securitysignup">
<input id="securityEmail" name="email" size="25" type="text" placeholder="Enter your email address">
<span class="btn-submit"><button name="email-button" type="submit" onclick="validateEmail();"><i class="fa fa-chevron-right" aria-hidden="true"></i></button></span>
<span class="subscriptionerrorMsg"></span>
</form>Text Content
Global Search
US About Us Resources Store
Log in
Cloud Services Console Customer Connect Partner Connect
* Multi-Cloud
* App Platform
* Cloud & Edge Infrastructure
* Anywhere Workspace
* Security
* Partners
Main Menu
TAKE CONTROL OF YOUR MULTI-CLOUD ENVIRONMENT
73% of enterprises use two or more public clouds today. While multi-cloud
accelerates digital transformation, it also introduces complexity and risk.
Simplicity Across Clouds Is Rare
91% of executives are looking to improve “consistency across [their] public
cloud environments."
Applications Need to Be Modernized
68% of developers want to expand use of modern application frameworks, APIs and
services.
Distributed Work Models Are Here to Stay
72% of enterprise employees are working from non-traditional environments.
Security Is a Top-Down Concern
Risk related to security, data and privacy issues remains the #1 multi-cloud
challenge.
SEE HOW VMWARE CAN HELP
VMWARE CROSS-CLOUD™ SERVICES ENABLE ORGANIZATIONS TO UNLOCK THE POTENTIAL OF
MULTI-CLOUD WITH ENTERPRISE SECURITY AND RESILIENCY.
BUILD & OPERATE CLOUD NATIVE APPS
Give developers the flexibility to use any app framework and tooling for a
secure, consistent and fast path to production on any cloud.
CONNECT & SECURE APPS & CLOUDS
Deliver security and networking as a built-in distributed service across users,
apps, devices, and workloads in any cloud.
AUTOMATE & OPTIMIZE APPS & CLOUDS
Operate apps and infrastructure consistently, with unified governance and
visibility into performance and costs across clouds.
ACCESS ANY APP ON ANY DEVICE
Empower your employees to be productive from anywhere, with secure, frictionless
access to enterprise apps from any device.
RUN ENTERPRISE APPS ANYWHERE
Run enterprise apps and platform services at scale across public and telco
clouds, data centers and edge environments.
LEARN ABOUT CROSS-CLOUD SERVICES
Main Menu
Multi-Cloud Spotlight
MODERNIZE FASTER ACROSS CLOUDS
MODERNIZE APPS FASTER WITH A MULTI-CLOUD KUBERNETES PLATFORM TO HELP YOU BUILD
AND RUN ALL APPS CONSISTENTLY ACROSS CLOUDS.
Get on a Faster Path to Prod
Build and deploy quickly and securely on any public cloud or on-premises
Kubernetes cluster.
Simplify Kubernetes Operations
Build and operate a secure, multi-cloud container infrastructure at scale.
Pair with App Development Experts
Unlock value by modernizing your existing apps and building innovative new
products.
LEARN MORE
APP PLATFORM
Build, run, secure, and manage all of your apps across any cloud with
application modernization solutions and guidance from VMware.
11 Security Practices to Manage Container Lifecycle
Get recommended practices for DevSecOps teams that desire a more modern app
methodology.
GAIN ACCESS NOW
SOLUTIONS & PRODUCTS
LEAD WITH DEVELOPER EXPERIENCE
Cloud Native Application Development Modern App Dev Practices Modernize Existing
Apps Start Your Modernization Tanzu Application Platform Tanzu Data Services
REALIZE DEVSECOPS OUTCOMES
Carbon Black Container Embrace DevSecOps Secure the Software Supply Chain Tanzu
Service Mesh
EMBRACE PLATFORM OPS
Build a Kubernetes Platform Tanzu Community Edition Tanzu Kubernetes Grid Tanzu
for Kubernetes Operations Tanzu Mission Control Tanzu Observability
CONNECT & SECURE MODERN APPS
Carbon Black Container Container Networking with Antrea Network Security NSX NSX
Advanced Load Balancer Tanzu Service Mesh
EMERGE AS A CLOUD NATIVE CSP
Telco Cloud Automation Telco Cloud Infrastructure Telco Cloud Operations Telco
Cloud Platform Telco Cloud Platform – Public Cloud Telco Cloud Platform – RAN
VMware RIC
QUICK LINKS
All Industries
ALL PRODUCTS
ALL SOLUTIONS
Main Menu
Multi-Cloud Spotlight
POWER OF ANY CLOUD WITH CONSISTENCY OF ONE
ACCELERATE CLOUD TRANSFORMATION WITH AN ENTERPRISE INFRASTRUCTURE, MULTI-CLOUD
OPERATIONS AND MODERN APP PLATFORM ACROSS THE EDGE AND ANY CLOUD.
Connect and Run with Confidence
Reduce time-to-value, lower costs, and enhance security while modernizing your
private and public cloud infrastructure.
Enhance Digital Experiences
Securely, reliably, and optimally connect applications in the cloud and at the
edge to deliver unique experiences.
LEARN MORE
CLOUD & EDGE INFRASTRUCTURE
Run enterprise apps at scale with a consistent cloud infrastructure across
public clouds, data centers and edge environments.
VMware Research: Multi-Cloud Strategies
Learn why enterprises find multi-cloud strategies critical for success.
SEE INTERACTIVE EBOOK
SOLUTIONS & PRODUCTS
CLOUD INFRASTRUCTURE
EXPLORE VMWARE CLOUD
Adopt Multi-Cloud Choose Hybrid Cloud Migrate to the Cloud VMware Cloud
Universal
SELECT CLOUD INFRASTRUCTURE
Alibaba Cloud VMware Service Azure VMware Solution Google Cloud VMware Engine
IBM Cloud for VMware Solutions Oracle Cloud VMware Solution VMware Cloud on AWS
VMware Cloud on AWS GovCloud (US) VMware Cloud on Dell EMC VMware Cloud Disaster
Recovery VMware Cloud Foundation VMware Verified Cloud Providers
GET A HYPERCONVERGED INFRASTRUCTURE
Dell EMC VxRail NSX NSX Advanced Load Balancer vCenter Server vSAN vSphere
OPERATE IN THE CLOUD
Accelerate Disaster Recovery Automate the Network Deploy a Sovereign Cloud
Enable Cloud Adoption Scale Capacity On Demand
TRANSFORM TELCO CLOUD
Edge Monetization Network Modernization Network Programmability RAN
Disaggregation
MANAGE THE CLOUD
CloudHealth CloudHealth Secure State vRealize Automation vRealize Cloud
Management vRealize Cloud Universal vRealize Log Insight vRealize Network
Insight vRealize Operations
SECURE CLOUD WORKLOADS
Carbon Black Container Carbon Black Workload CloudHealth Secure State NSX
Advanced Load Balancer NSX Distributed Firewall NSX Distributed IDS/IPS
EDGE
ENABLE THE MULTI-CLOUD EDGE
Edge Compute Stack Edge Network Intelligence Empower Remote Work Optimize and
Secure the WAN SD-WAN Secure Access Secure Access Service Edge (SASE) Telco Edge
VMware Cloud Web Security
QUICK LINKS
All Industries Cloud Platform Tech Zone VMware Tech Zone
ALL PRODUCTS
ALL SOLUTIONS
Main Menu
Multi-Cloud Spotlight
MULTI-CLOUD & ANYWHERE WORKSPACE
EMPOWER YOUR EMPLOYEES TO BE PRODUCTIVE FROM ANYWHERE, WITH SECURE, FRICTIONLESS
ACCESS TO ENTERPRISE APPS FROM ANY DEVICE.
Deliver an Engaging Experience
Put employees first with device choice, flexibility, and seamless, consistent,
high-quality experiences.
Secure Today’s Anywhere Workspace
Ease the move to Zero Trust with situational intelligence and connected control
points.
Automate the Workspace
Manage to outcomes — not tasks — with intelligent compliance, workflow and
performance management.
LEARN MORE
ANYWHERE WORKSPACE
Enable any employee to work from anywhere, anytime with seamless employee
experiences.
Remote Work Is No Longer Optional
Shift from supporting remote work to becoming an anywhere organization.
DOWNLOAD BRIEF
SOLUTIONS & PRODUCTS
EMBRACE ANYWHERE WORKSPACE
Digital Employee Experience Endpoint Protection End User Adoption SaaS App
Management Secure Remote Access Virtual Desktops and Applications Web Protection
Workspace ONE Workspace ONE UEM
ENSURE EXPERIENCE AND PRODUCTIVITY
Workspace ONE Access Workspace ONE Assist Workspace ONE Intelligence Workspace
ONE Intelligent Hub Workspace ONE Productivity Apps
ENABLE MODERN MANAGEMENT
Workspace ONE Freestyle Orchestrator Workspace ONE Intelligence Workspace ONE
UEM Workspace ONE UEM for Mac Workspace ONE for Windows
SCALE WITH VDI & DAAS
Horizon Horizon Cloud NSX Advanced Load Balancer Workspace ONE Assist for
Horizon
EMPOWER FRONTLINE WORKERS
Workspace ONE Assist Workspace ONE Intelligence Workspace ONE Launcher Workspace
ONE for Rugged Devices Workspace ONE UEM Workspace ONE for Workspace IoT
Endpoints
SECURE THE HYBRID WORKFORCE
Carbon Black Endpoint Secure Access VMware Cloud Web Security Workspace ONE
Access Workspace ONE Intelligence
QUICK LINKS
All Industries Workspace Tech Zone
ALL PRODUCTS
ALL SOLUTIONS
Main Menu
Multi-Cloud Spotlight
MULTI-CLOUD SECURITY & NETWORKING
WITH CONNECTED SECURITY THAT DELIVERS FULL VISIBILITY AND FRICTIONLESS
OPERATIONS, YOUR APPS AND DATA ARE MORE SECURE WITH VMWARE, IN ANY ENVIRONMENT.
Secure & Connect Workloads
Operationalize consistent security and networking across apps, users, and
entities with transparency built into our tools.
Protect APIs — the New Endpoints
Increase app velocity and centrally manage, secure, connect, and govern your
clusters no matter where they reside.
Be Future-Ready
Get built-in threat intelligence spanning users, endpoints and networks to
evolve your protection in a dynamic landscape.
LEARN MORE
SECURITY & NETWORKING
Deliver security and networking as a built-in distributed service across users,
apps, devices, and workloads in any cloud.
Protect Your Multi-Cloud Environments
Discover the unique characteristics of malware and how to stay ahead of attacks.
GET THREAT REPORT
SOLUTIONS & PRODUCTS
SECURITY
MODERNIZE THE SOC
Carbon Black Cloud Carbon Black Endpoint Carbon Black MDR NSX Distributed
IDS/IPS NSX Network Detection and Response NSX Sandbox Security Professional
Services
SECURE MULTI-CLOUD WORKLOADS
Carbon Black App Control Carbon Black Container Carbon Black Workload
CloudHealth Secure State NSX Distributed Firewall NSX Distributed IDS/IPS
Ransomware Protection
SECURE MODERN APPS
Carbon Black Container Container Networking with Antrea Tanzu Service Mesh
SECURE THE HYBRID WORKFORCE
Carbon Black App Control Carbon Black Endpoint SASE Platform SD-WAN Secure
Access
NETWORKING
BUILD A MODERN NETWORK
Accelerate Cloud Adoption Automate the Network Connect and Secure Modern Apps
Connect Containers and Kubernetes Container Networking with Antrea NSX NSX
Advanced Load Balancer NSX Distributed Firewall Rethink Application Delivery
Tanzu Service Mesh
STRENGTHEN APP & NETWORK ACCESS
Edge Network Intelligence Empower Remote Work Optimize and Secure the WAN SD-WAN
Secure Access Secure Access Service Edge (SASE) VMware Cloud Web Security
SECURE YOUR NETWORK
NSX Distributed Firewall NSX Distributed IDS/IPS NSX Firewall NSX Gateway
Firewall NSX Network Detection & Response NSX Sandbox
AUTOMATE THE NETWORK
Global Network Identities HCX Workload Mobility NSX Intelligence vRealize
Network Insight
QUICK LINKS
All Industries Carbon Black Tech Zone NSX Tech Zone
ALL PRODUCTS
ALL SOLUTIONS
Main Menu
Multi-Cloud Spotlight
TRUSTED ADVISORS ON MULTI-CLOUD JOURNEY
PARTNERS ARE TRUSTED ADVISORS TO GUIDE CUSTOMERS’ JOURNEYS TO MULTI-CLOUD,
ENABLING DIGITAL INNOVATION WITH ENTERPRISE CONTROL.
Work with a VMware Partner
Partners deliver outcomes with their expertise and VMware technology, creating
exceptional value for our mutual customers.
Become a Partner
Together with our partners, VMware is building the new multi-cloud ecosystem
positioned to become essential to our customers.
LEARN MORE
PARTNERS
With thousands of partners worldwide, we are positioned to help customers scale
their business, drive innovation and transform their customer experience.
Working Together with Partners for Customer Success
See how we work with a global partner to help companies prepare for multi-cloud.
VIEW PARTNER STORY
SOLUTIONS
FOR CUSTOMERS
Find a Cloud Provider Find a Partner VMware Marketplace Work with a Partner
FOR PARTNERS
Become a Cloud Provider Cloud Partner Navigator Get Cloud Verified Learning and
Selling Resources Partner Connect Login Partner Executive Edge Technology
Partner Hub Work with VMware
Ellipsis
VMware Security Solutions Advisories VMSA-2022-0011
Critical
Advisory ID: VMSA-2022-0011.1
CVSSv3 Range: 5.3-9.8
Issue Date: 2022-04-06
Updated On: 2022-04-13
CVE(s): CVE-2022-22954, CVE-2022-22955,CVE-2022-22956, CVE-2022-22957,
CVE-2022-22958, CVE-2022-22959, CVE-2022-22960, CVE-2022-22961
Synopsis: VMware Workspace ONE Access, Identity Manager and vRealize Automation
updates address multiple vulnerabilities.
RSS Feed
Download PDF
Download Text File
Share this page on social media
Sign up for Security Advisories
1. IMPACTED PRODUCTS
* VMware Workspace ONE Access (Access)
* VMware Identity Manager (vIDM)
* VMware vRealize Automation (vRA)
* VMware Cloud Foundation
* vRealize Suite Lifecycle Manager
2. INTRODUCTION
Multiple vulnerabilities were privately reported to VMware. Patches are
available to remediate these vulnerabilities in affected VMware products.
3A. SERVER-SIDE TEMPLATE INJECTION REMOTE CODE EXECUTION VULNERABILITY
(CVE-2022-22954)
Description
VMware Workspace ONE Access and Identity Manager contain a remote code execution
vulnerability due to server-side template injection. VMware has evaluated the
severity of this issue to be in the Critical severity range with a maximum
CVSSv3 base score of 9.8.
Known Attack Vectors
A malicious actor with network access can trigger a server-side template
injection that may result in remote code execution.
Resolution
To remediate CVE-2022-22954, apply the patches listed in the 'Fixed Version'
column of the 'Resolution Matrix' found below.
Workarounds
Workarounds for CVE-2022-22954 have been documented in the VMware Knowledge Base
articles listed in the 'Workarounds' column of the 'Response Matrix' below.
Additional Documentation
A supplemental blog post was created for additional clarification. Please
see: https://via.vmw.com/vmsa-2022-0011-qna
Notes
VMware has confirmed that exploitation of CVE-2022-22954 has occurred in the
wild.
Acknowledgements
VMware would like to thank Steven Seeley (mr_me) of Qihoo 360 Vulnerability
Research Institute for reporting these issues to us.
3B. OAUTH2 ACS AUTHENTICATION BYPASS VULNERABILITIES (CVE-2022-22955,
CVE-2022-22956)
Description
VMware Workspace ONE Access has two authentication bypass vulnerabilities in the
OAuth2 ACS framework. VMware has evaluated the severity of these issues to be in
the Critical severity range with a maximum CVSSv3 base score of 9.8.
Known Attack Vectors
A malicious actor may bypass the authentication mechanism and execute any
operation due to exposed endpoints in the authentication framework.
Resolution
To remediate CVE-2022-22955 and CVE-2022-22956, apply the patches listed in the
'Fixed Version' column of the 'Resolution Matrix' found below.
Workarounds
Workarounds for CVE-2022-22955 and CVE-2022-22956 have been documented in the
VMware Knowledge Base articles listed in the 'Workarounds' column of the
'Response Matrix' below.
Additional Documentation
A supplemental blog post was created for additional clarification. Please
see: https://via.vmw.com/vmsa-2022-0011-qna
Notes
These issues only impact Workspace ONE Access.
Acknowledgements
VMware would like to thank Steven Seeley (mr_me) of Qihoo 360 Vulnerability
Research Institute for reporting these issues to us.
3C. JDBC INJECTION REMOTE CODE EXECUTION VULNERABILITIES (CVE-2022-22957,
CVE-2022-22958)
Description
VMware Workspace ONE Access, Identity Manager and vRealize
Automation contain two remote code execution vulnerabilities. VMware has
evaluated the severity of these issues to be in the Critical severity range with
a maximum CVSSv3 base score of 9.1.
Known Attack Vectors
A malicious actor with administrative access can trigger deserialization of
untrusted data through malicious JDBC URI which may result in remote code
execution.
Resolution
To remediate CVE-2022-22957 and CVE-2022-22958, apply the patches listed in the
'Fixed Version' column of the 'Resolution Matrix' found below.
Workarounds
Workarounds for CVE-2022-22957 and CVE-2022-22958 have been documented in the
VMware Knowledge Base articles listed in the 'Workarounds' column of the
'Response Matrix' below.
Additional Documentation
A supplemental blog post was created for additional clarification. Please
see: https://via.vmw.com/vmsa-2022-0011-qna
Notes
None.
Acknowledgements
VMware would like to thank Steven Seeley (mr_me) of Qihoo 360 Vulnerability
Research Institute for reporting these issues to us.
3D. CROSS SITE REQUEST FORGERY VULNERABILITY (CVE-2022-22959)
Description
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a
cross site request forgery vulnerability. VMware has evaluated the severity of
this issue to be in the Important severity range with a maximum CVSSv3 base
score of 8.8.
Known Attack Vectors
A malicious actor can trick a user through a cross site request forgery to
unintentionally validate a malicious JDBC URI.
Resolution
To remediate CVE-2022-22959, apply the patches listed in the 'Fixed Version'
column of the 'Resolution Matrix' found below.
Workarounds
Workarounds for CVE-2022-22959 have been documented in the VMware Knowledge Base
articles listed in the 'Workarounds' column of the 'Response Matrix' below.
Additional Documentation
A supplemental blog post was created for additional clarification. Please
see: https://via.vmw.com/vmsa-2022-0011-qna
Notes
None.
Acknowledgements
VMware would like to thank Steven Seeley (mr_me) of Qihoo 360 Vulnerability
Research Institute for reporting these issues to us.
3E. LOCAL PRIVILEGE ESCALATION VULNERABILITY (CVE-2022-22960)
Description
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a
privilege escalation vulnerability due to improper permissions in support
scripts. VMware has evaluated the severity of this issue to be in the Important
severity range with a maximum CVSSv3 base score of 7.8.
Known Attack Vectors
A malicious actor with local access can escalate privileges to 'root'.
Resolution
To remediate CVE-2022-22960, apply the patches listed in the 'Fixed Version'
column of the 'Resolution Matrix' found below.
Workarounds
Workarounds for CVE-2022-22960 have been documented in the VMware Knowledge Base
articles listed in the 'Workarounds' column of the 'Response Matrix' below.
Additional Documentation
A supplemental blog post was created for additional clarification. Please
see: https://via.vmw.com/vmsa-2022-0011-qna
Notes
VMware has confirmed that exploitation of CVE-2022-22960 has occurred in the
wild.
Acknowledgements
VMware would like to thank Steven Seeley (mr_me) of Qihoo 360 Vulnerability
Research Institute for reporting these issues to us.
3F. INFORMATION DISCLOSURE VULNERABILITY (CVE-2022-22961)
Description
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an
information disclosure vulnerability due to returning excess information. VMware
has evaluated the severity of this issue to be in the Moderate severity
range with a maximum CVSSv3 base score of 5.3.
Known Attack Vectors
A malicious actor with remote access may leak the hostname of the target system.
Successful exploitation of this issue can lead to targeting victims.
Resolution
To remediate CVE-2022-22961, apply the patches listed in the 'Fixed Version'
column of the 'Resolution Matrix' found below.
Workarounds
Workarounds for CVE-2022-22961 have been documented in the VMware Knowledge Base
articles listed in the 'Workarounds' column of the 'Response Matrix' below.
Additional Documentation
A supplemental blog post was created for additional clarification. Please
see: https://via.vmw.com/vmsa-2022-0011-qna
Notes
None.
Acknowledgements
VMware would like to thank Steven Seeley (mr_me) of Qihoo 360 Vulnerability
Research Institute for reporting these issues to us.
Response Matrix - Access 21.08.x:
Product Version Running On CVE Identifier CVSSv3 Severity Fixed Version
Workarounds Additional Documentation
Access
21.08.0.1, 21.08.0.0
Linux
CVE-2022-22954
9.8
critical
KB88099
KB88098
FAQ
Access
21.08.0.1, 21.08.0.0
Linux
CVE-2022-22955, CVE-2022-22956
9.8
critical
KB88099
KB88098
FAQ
Access
21.08.0.1, 21.08.0.0
Linux
CVE-2022-22957, CVE-2022-22958
9.1
critical
KB88099
KB88098
FAQ
Access
21.08.0.1, 21.08.0.0
Linux
CVE-2022-22959
8.8
important
KB88099
KB88098
FAQ
Access
21.08.0.1, 21.08.0.0
Linux
CVE-2022-22960
7.8
important
KB88099
KB88098
FAQ
Access
21.08.0.1, 21.08.0.0
Linux
CVE-2022-22961
5.3
moderate
KB88099
None
FAQ
Response Matrix - Access 20.10.x:
Product Version Running On CVE Identifier CVSSv3 Severity Fixed Version
Workarounds Additional Documentation
Access
20.10.0.1, 20.10.0.0
Linux
CVE-2022-22954
9.8
critical
KB88099
KB88098
FAQ
Access
20.10.0.1, 20.10.0.0
Linux
CVE-2022-22955, CVE-2022-22956
9.8
critical
KB88099
KB88098
FAQ
Access
20.10.0.1, 20.10.0.0
Linux
CVE-2022-22957, CVE-2022-22958
9.1
critical
KB88099
KB88098
FAQ
Access
20.10.0.1, 20.10.0.0
Linux
CVE-2022-22959
8.8
important
KB88099
KB88098
FAQ
Access
20.10.0.1, 20.10.0.0
Linux
CVE-2022-22960
7.8
important
KB88099
KB88098
FAQ
Access
20.10.0.1, 20.10.0.0
Linux
CVE-2022-22961
5.3
moderate
KB88099
None
FAQ
Response Matrix - Identity Manager 3.3.x:
Product Version Running On CVE Identifier CVSSv3 Severity Fixed Version
Workarounds Additional Documentation
vIDM
3.3.6, 3.3.5, 3.3.4, 3.3.3
Linux
CVE-2022-22954
9.8
critical
KB88099
KB88098
FAQ
vIDM
3.3.6, 3.3.5, 3.3.4, 3.3.3
Linux
CVE-2022-22955, CVE-2022-22956
N/A
N/A
Unaffected
N/A
N/A
vIDM
3.3.6, 3.3.5, 3.3.4, 3.3.3
Linux
CVE-2022-22957, CVE-2022-22958
9.1
critical
KB88099
KB88098
FAQ
vIDM
3.3.6, 3.3.5, 3.3.4, 3.3.3
Linux
CVE-2022-22959
8.8
important
KB88099
KB88098
FAQ
vIDM
3.3.6, 3.3.5, 3.3.4, 3.3.3
Linux
CVE-2022-22960
7.8
important
KB88099
KB88098
FAQ
vIDM
3.3.6, 3.3.5, 3.3.4, 3.3.3
Linux
CVE-2022-22961
5.3
moderate
KB88099
None
FAQ
Response Matrix - vRealize Automation (vIDM):
Product Version Running On CVE Identifier CVSSv3 Severity Fixed Version
Workarounds Additional Documentation
vRealize Automation [1]
8.x
Linux
CVE-2022-22954, CVE-2022-22955, CVE-2022-22956, CVE-2022-22957, CVE-2022-22958,
CVE-2022-22959, CVE-2022-22960, CVE-2022-22961
N/A
N/A
Unaffected
N/A
N/A
vRealize Automation (vIDM)
7.6
Linux
CVE-2022-22954
N/A
N/A
Unaffected
N/A
N/A
vRealize Automation (vIDM)
7.6
Linux
CVE-2022-22955, CVE-2022-22956
N/A
N/A
Unaffected
N/A
N/A
vRealize Automation (vIDM) [2]
7.6
Linux
CVE-2022-22957, CVE-2022-22958
9.1
critical
KB88099
KB88098
FAQ
vRealize Automation (vIDM) [2]
7.6
Linux
CVE-2022-22959
8.8
important
KB88099
KB88098
FAQ
vRealize Automation (vIDM) [2]
7.6
Linux
CVE-2022-22960
7.8
important
KB88099
KB88098
FAQ
vRealize Automation (vIDM)
7.6
Linux
CVE-2022-22961
N/A
N/A
Unaffected
N/A
N/A
[1] vRealize Automation 8.x is unaffected since it does not use embedded vIDM.
If vIDM has been deployed with vRA 8.x, fixes should be applied directly to
vIDM.
[2] vRealize Automation 7.6 is affected since it uses embedded vIDM.
Impacted Product Suites that Deploy Response Matrix Components:
Product Version Running On CVE Identifier CVSSv3 Severity Fixed Version
Workarounds Additional Documentation
VMware Cloud Foundation (vIDM)
4.x
Any
CVE-2022-22954, CVE-2022-22957, CVE-2022-22958, CVE-2022-22959, CVE-2022-22960,
CVE-2022-22961
9.8, 9.1, 9.1, 8.8, 7.8, 5.3
critical
KB88099
KB88098
FAQ
VMware Cloud Foundation (vRA)
3.x
Any
CVE-2022-22957, CVE-2022-22958, CVE-2022-22959, CVE-2022-22960
9.1, 9.1, 8.8, 7.8
critical
KB88099
KB88098
FAQ
vRealize Suite Lifecycle Manager (vIDM)
8.x
Any
CVE-2022-22954, CVE-2022-22957, CVE-2022-22958, CVE-2022-22959, CVE-2022-22960,
CVE-2022-22961
9.8, 9.1, 9.1, 8.8, 7.8, 5.3
critical
KB88099
KB88098
FAQ
4. REFERENCES
Fixed Version(s): https://kb.vmware.com/s/article/88099
Workarounds: https://kb.vmware.com/s/article/88098
Mitre CVE Dictionary Links:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22954
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22955
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22956
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22957
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22958
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22959
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22960
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22961
FIRST CVSSv3 Calculator:
CVE-2022-22954: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-22955: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-22956: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-22957: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVE-2022-22958: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVE-2022-22959: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-22960: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-22961: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
5. CHANGE LOG
2022-04-06: VMSA-2022-0011
Initial security advisory.
2022-04-13: VMSA-2022-0011.1
VMware has confirmed that exploitation of CVE-2022-22954 has occurred in the
wild.
6. CONTACT
E-mail list for product security notifications and announcements:
https://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
security-announce@lists.vmware.com
bugtraq@securityfocus.com
fulldisclosure@seclists.org
E-mail: security@vmware.com
PGP key at:
https://kb.vmware.com/kb/1055
VMware Security Advisories
https://www.vmware.com/security/advisories
VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html
VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html
VMware Security & Compliance Blog
https://blogs.vmware.com/security
Twitter
https://twitter.com/VMwareSRC
Copyright 2022 VMware Inc. All rights reserved.
Company
About Us Executive Leadership News & Stories Investor Relations Customer Stories
Diversity, Equity & Inclusion Environment, Social & Governance
Careers Blogs Communities Acquisitions Office Locations VMware Cloud Trust
Center COVID-19 Resources
Support
VMware Customer Connect Support Policies Product Documentation Compatibility
Guide End User Terms & Conditions California Transparency Act Statement
Twitter YouTube Facebook LinkedIn Contact Sales
--------------------------------------------------------------------------------
© 2022 VMware, Inc. Terms of Use Your California Privacy Rights Privacy
Accessibility Site Map Trademarks Glossary Help
Cookie Settings
We use cookies to provide you with the best experience on our website, to
improve usability and performance and thereby improve what we offer to you. Our
website may also use third-party cookies to display advertising that is more
relevant to you. By clicking on the “Accept All” button you agree to the storing
of cookies on your device. If you want to know more about how we use cookies,
please see our Cookie Policy.
Cookie Settings Accept All Cookies
COOKIE PREFERENCE CENTER
GENERAL INFORMATION ON COOKIES
GENERAL INFORMATION ON COOKIES
When you visit our website, we use cookies to ensure that we give you the best
experience. This information does not usually directly identify you, but it can
give you a more personalized web experience. Because we respect your right to
privacy, you can choose not to allow some types of cookies by clicking on the
different category headings to find out more and change your settings. However,
blocking some types of cookies may impact your experience on the site and the
services we are able to offer. Further information can be found in our
Cookie Policy.
* STRICTLY NECESSARY
STRICTLY NECESSARY
Always Active
Strictly Necessary
Strictly necessary cookies are always enabled since they are essential for
our website to function. They enable core functionality such as security,
network management, and website accessibility. You can set your browser to
block or alert you about these cookies, but this may affect how the website
functions. For more information please visit www.aboutcookies.org or
www.allaboutcookies.org.
Cookie Details
* PERFORMANCE
PERFORMANCE
Performance
Performance cookies are used to analyze the user experience to improve our
website by collecting and reporting information on how you use it. They allow
us to know which pages are the most and least popular, see how visitors move
around the site, optimize our website and make it easier to navigate.
Cookie Details
* FUNCTIONAL
FUNCTIONAL
Functional
Functional cookies help us keep track of your past browsing choices so we can
improve usability and customize your experience. These cookies enable the
website to remember your preferred settings, language preferences, location
and other customizable elements such as font or text size. If you do not
allow these cookies, then some or all of these services may not function
properly.
Cookie Details
* ADVERTISING
ADVERTISING
Advertising
Advertising cookies are used to send you relevant advertising and promotional
information. They may be set through our site by third parties to build a
profile of your interests and show you relevant advertisements on other
sites. These cookies do not directly store personal information, but their
function is based on uniquely identifying your browser and internet device.
Cookie Details
* SOCIAL MEDIA
SOCIAL MEDIA
Social Media
Social media cookies are intended to facilitate the sharing of content and to
improve the user experience. These cookies can sometimes track your
activities. We do not control social media cookies and they do not allow us
to gain access to your social media accounts. Please refer to the relevant
social media platform’s privacy policies for more information.
Cookie Details
Back Button
ADVERTISING COOKIES
Filter Button
Consent Leg.Interest
Select All Vendors
Select All Vendors
Select All Hosts
Select All
* REPLACE-WITH-DYANMIC-HOST-ID
View Third Party Cookies
* Name
cookie name
Clear Filters
Information storage and access
Apply
Confirm My Choices Allow All