CVE-2022-22956

EPSS 50.7%◆ VulnCheck KEV

Vexday Risk Score

52Atenção

Decisão SSVC (CISA)

Act

Exploração + impacto → ação imediata

Maturidade do exploit

Exploit funcional

Exploit automatizável disponível (Nuclei/Metasploit).

CVSS —EPSS 50.7%KEV nãoPoC —Nuclei simMetasploit simPatch —

Ciclo de vida

06 abr 2022Exploit Metasploit disponível

13 abr 2022Publicada no NVD

Recomendação: Corrigir o quanto antes — há exploração ativa confirmada.

VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may bypass the authentication mechanism and execute any operation due to exposed endpoints in the authentication framework.

Produtos afetados

n/a · VMware Workspace ONE Access

Referências

http://packetstormsecurity.com/files/171918/Mware-Workspace-ONE-Remote-Code-Execution.html http://packetstormsecurity.com/files/171918/VMware-Workspace-ONE-Remote-Code-Execution.html https://www.vmware.com/security/advisories/VMSA-2022-0011.html