Log in Start free

Actively exploited · Published Apr 13, 2022 · Assigned by vmware

CVE-2022-22960

High 7.8 Exploited

In plain English

A high-severity incorrect permission assignment in VMware Workspace ONE Access, Identity Manager and vRealize Automation. Attackers are actively exploiting it in the wild (listed by CISA on April 15, 2022). The chance it is exploited in the next 30 days is estimated at 35.5% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. Apply updates per vendor instructions.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)35.5%top 1.5% of all CVEs
Exploited in the wildYesCISA KEV since Apr 15, 2022
Attack tooling1Metasploit

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 6, 2022.

Official description

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor with local access can escalate privileges to 'root'.

Affected products (as reported)

VendorProductVersions
n/a VMware Workspace ONE Access, Identity Manager and vRealize Automation Access 21.08.0.1, 21.08.0.0, 20.10.0.1, 20.10.0.0. Identity Manager 3.3.6, 3.3.5, 3.3.4, 3.3.3. vRealize Automation 7.6.

Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References