Deserialization of untrusted data

2022-04-1318:15:00

PRIOn knowledge base

www.prio-n.com

7.6 High

AI Score

Confidence

High

0.02 Low

EPSS

Percentile

88.8%

JSON

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A malicious actor with administrative access can trigger deserialization of untrusted data through malicious JDBC URI which may result in remote code execution.

CPENameOperatorVersion
cloud_foundationge3.0
cloud_foundationlt5.0
identity_managereq3.3.3
identity_managereq3.3.4
identity_managereq3.3.5
identity_managereq3.3.6
vrealize_automationge8.0
vrealize_automationlt9.0
vrealize_automationeq7.6
vrealize_suite_lifecycle_managerge8.0

Name	Operator	Version
cloud_foundation	ge	3.0
cloud_foundation	lt	5.0
identity_manager	eq	3.3.3
identity_manager	eq	3.3.4
identity_manager	eq	3.3.5
identity_manager	eq	3.3.6
vrealize_automation	ge	8.0
vrealize_automation	lt	9.0
vrealize_automation	eq	7.6
vrealize_suite_lifecycle_manager	ge	8.0