URL Injection Vulnerability in VMware Workspace ONE Access and Identity Manager
CVE-2022-31657

9.8CRITICAL

Key Information:

Vendor

Vmware
Status
Vmware Workspace One Access, Identity Manager And Vrealize Automation
Vendor
CVE Published:
5 August 2022

What is CVE-2022-31657?

VMware Workspace ONE Access and Identity Manager are affected by a URL injection vulnerability that allows malicious actors with network access the potential to redirect authenticated users to arbitrary domains. This vulnerability could compromise user credentials and lead to unauthorized access to sensitive information. It highlights the importance of securing network paths and user interactions with such products to prevent exploitation.

Affected Version(s)

VMware Workspace ONE Access, Identity Manager and vRealize Automation Workspace One Access (21.08.0.1 & 21.08.0.0), Identity Manager (vIDM) (3.3.6, 3.3.5 & 3.3.4), and vRealize Automation 7.6

References

https://www.vmware.com/security/advisories/VMSA-2022-0021...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.