High severity · published Dec 14, 2022
CVE-2022-31700
VMware Workspace ONE Access and Identity Manager contain an authenticated remote code execution vulnerability
7.2
CVSS
1.2%
EPSS
No
On KEV
Description
VMware Workspace ONE Access and Identity Manager contain an authenticated remote code execution vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WO
Workspace ONE Access · VMware
3.3.6 · source: NVD
AC
Access · Vmware
21.08.0.0; 21.08.0.1 · source: NVD
CF
Cloud Foundation · Vmware
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-31700
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-31700
Vendor Advisory
https://www.vmware.com/security/advisories/VMSA-2022-0032.html
More from Workspace ONE Access
9.8
CVE-2022-22954
VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability
9.1
CVE-2020-4006
Multiple VMware Products Command Injection Vulnerability
7.8
CVE-2022-22960
VMware Multiple Products Privilege Escalation Vulnerability
9.8
CVE-2022-31657
VMware Workspace ONE Access and Identity Manager contain a URL injection vulnerability
9.8
CVE-2022-31656
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users