7.8
High
CVE-2022-22960 VMware Multiple Products Privilege Escalation Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply updates per vendor instructions.
Ransomware campaigns
Not observed so far
Weakness
CWE-250
Description
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor with local access can escalate privileges to 'root'.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| VMware Workspace ONE Access, Identity Manager and vRealize Automation | Versions not published |
Other CVEs of VMware Workspace ONE Access, Identity Manager and vRealize Automation
The 14 CVEs of VMware Workspace ONE Access, Identity Manager and vRealize Automation →
CVE-2022-31657
VMware Workspace ONE Access and Identity Manager contain a URL injection vulnerability
Not rated
CVE-2022-31656
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability…
Not rated
CVE-2022-31658
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability
Not rated
CVE-2022-31661
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two privilege escalation vulnerabilities
Not rated