CVE-2022-22973

CWE-269 — Improper Privilege Management6 documents5 sources
Severity
7.8HIGH
EPSS
0.4%
top 37.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Vmware Cloud FoundationVmware Identity ManagerVmware Vrealize Suite Lifecycle Manager+1 more
Timeline
PublishedMay 20
Latest updateMay 21

Description

VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages5 packages

▶CVEListV5vmware_workspace_one_access_and_identity_manager.Access 21.08.0.1, 21.08.0.0, 20.10.0.1, 20.10.0.0. Identity Manager 3.3.6, 3.3.5, 3.3.4, 3.3.3.
▶NVDvmware/workspace_one_access4 versions+3
▶NVDvmware/identity_manager4 versions+3
▶NVDvmware/cloud_foundation8 versions+7

🔴Vulnerability Details

2
GHSA
GHSA-4hvh-jpvg-gwfm: VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability↗2022-05-21
▶
CVEList
CVE-2022-22973: VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability↗2022-05-20
▶

📋Vendor Advisories

1
VMware
VMware Workspace ONE Access, Identity Manager and vRealize Automation updates address multiple vulnerabilities.↗2022-05-18
▶

🕵️Threat Intelligence

1
Unit42
Threat Brief: VMware Vulnerabilities Exploited in the Wild (CVE-2022-22954 and Others)↗2022-05-20
▶
CVE-2022-22973 (HIGH CVSS 7.8) | VMware Workspace ONE Access and Ide | cvebase.io