CVE-2022-22957

2022-04-1300:00:00

vmware

www.cve.org

vmware

workspace one access

identity manager

vrealize automation

remote code execution

deserialization

malicious actor

administrative access

jdbc uri

untrusted data

AI Score

8.4

Confidence

High

EPSS

0.02

Percentile

88.8%

JSON

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A malicious actor with administrative access can trigger deserialization of untrusted data through malicious JDBC URI which may result in remote code execution.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "VMware Workspace ONE Access, Identity Manager and vRealize Automation.",
    "versions": [
      {
        "version": "Access 21.08.0.1, 21.08.0.0, 20.10.0.1, 20.10.0.0. Identity Manager 3.3.6, 3.3.5, 3.3.4, 3.3.3. vRealize Automation 7.6.",
        "status": "affected"
      }
    ]
  }
]