VMware warns of security vulnerabilities | Pentest7

top cybersecurity companies

VMware warns of critical error in remote code execution in Workspace ONE Access. Other serious security vulnerabilities have been fixed.

VMware is urging its customers to update their software to address critical vulnerabilities, including a Remote Code Execution (RCE) bug in Workspace ONE Access. On Wednesday, the tech giant released a security advisory warning of vulnerabilities in its enterprise software. The products affected are VMware Workspace ONE Access, VMware Identity Manager (vIDM), VMware vRealize Automation (vRA), VMware Cloud Foundation and vRealize Suite Lifecycle Manager.

The first vulnerability is CVE-2022-22954, which affects VMware Workspace ONE Access and Identity Manager. CVE-2022-22954 is described as a server-side Template Injection RCE and has a CVSS Severity Score of 9.8. The vulnerability can be exploited by attackers as long as they have access to the network.

VMware has also developed patches to address the CVE-2022-22955 and CVE-2022-22956 vulnerabilities; both have a CVSS score of 9.8 and affect VMware Workspace ONE Access. The vulnerabilities were found in the OAuth2 ACS framework.

According to the vendor, a malicious actor can bypass the authentication mechanism and perform arbitrary operations due to exposed endpoints in the authentication framework.

Two other bugs, CVE-2022-22957 and CVE-2022-22958 (CVSS 9.1), have been fixed in Workspace ONE Access, Identity Manager, and vRealize Automation. Threat actors could trigger the deserialization of untrusted data via the JDBC URI parameter that manages Java applications and their database connections to trigger an RCE. However, the attackers must have administrative rights.

The same software trio was also vulnerable to CVE-2022-22959 (CVSS 8.8), a cross-site request forgery (CSRF) bug that can be used to validate a malicious JDBC URI.

VMware has also fixed CVE-2022-22960 (CVSS 7.8), a local privilege elevation bug, and CVE-2022-22961 (CVSS 5.3), an information leak in Workspace ONE Access, Identity Manager, and vRealize Automation. VMware has found no evidence that the vulnerabilities are actively being exploited.

Patches are available, but if this is not possible, the manufacturer has also provided workaround guides to mitigate the risk of attack.

Other VMware news this month concerns the vendor’s open-source SpringShell/Spring4Shell framework, a critical vulnerability at the core of the software that can be exploited for Remote Code Execution (RCE).

Spring4Shell is listed as CVE-2022-22965 and has a CVSS score of 8.1. Tomcat servicers using Spring MVC/WebFlux with JDK 9+ are affected. In addition, the vulnerability also affects VMware Tanzu Application Service for VMs, Tanzu Operations Manager and Tanzu Kubernetes Grid Integrated Edition.

Leave a Reply

Your email address will not be published.