Reflected Cross-Site Scripting Vulnerability in VMware Workspace ONE Assist
CVE-2022-31688

6.1MEDIUM

Key Information:

Vendor
Vmware
Status
Vmware Workspace One Assist
Vendor
CVE Published:
9 November 2022

Summary

VMware Workspace ONE Assist prior to version 22.10 suffers from a reflected cross-site scripting vulnerability. This flaw arises from insufficient sanitization of user inputs, allowing a malicious user to inject malicious JavaScript code into the browser of a targeted user via crafted requests. When exploited, this vulnerability could allow attackers to manipulate user sessions or carry out phishing attacks, posing significant risks to both users and organizations.

Affected Version(s)

VMware Workspace ONE Assist VMware Workspace ONE Assist prior to 22.10

References

https://www.vmware.com/security/advisories/VMSA-2022-0028...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.