VMSA-2022-0021

• VMware Workspace ONE Access (Access)
• VMware Workspace ONE Access Connector (Access Connector)
• VMware Identity Manager (vIDM)
• VMware Identity Manager Connector (vIDM Connector)
• VMware vRealize Automation (vRA)
• VMware Cloud Foundation
• vRealize Suite Lifecycle Manager

Multiple vulnerabilities were privately reported to VMware. Patches are available to remediate these vulnerabilities in affected VMware products.

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.

A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.

To remediate CVE-2022-31656, apply the patches listed in the ‘Fixed Version’ column of the ‘Resolution Matrix’ found below.

Workarounds for CVE-2022-31656 have been documented in the VMware Knowledge Base articles listed in the ‘Workarounds’ column of the ‘Response Matrix’ below.

A supplemental blog post was created for additional clarification. Please see: https://via.vmw.com/vmsa-2022-0021-questions-answers-faq

None.

VMware would like to thank PetrusViet (a member of VNG Security) for reporting this issue to us.

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.0.

A malicious actor with administrator and network access can trigger a remote code execution. 

To remediate CVE-2022-31658, apply the patches listed in the ‘Fixed Version’ column of the ‘Resolution Matrix’ found below.

None.

A supplemental blog post was created for additional clarification. Please see: https://via.vmw.com/vmsa-2022-0021-questions-answers-faq

None.

VMware would like to thank PetrusViet (a member of VNG Security) for reporting this issue to us.

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.0.

A malicious actor with administrator and network access can trigger a remote code execution. 

To remediate CVE-2022-31659, apply the patches listed in the ‘Fixed Version’ column of the ‘Resolution Matrix’ found below.

None.

A supplemental blog post was created for additional clarification. Please see: https://via.vmw.com/vmsa-2022-0021-questions-answers-faq

None.

VMware would like to thank PetrusViet (a member of VNG Security) for reporting this issue to us.

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two privilege escalation vulnerabilities. VMware has evaluated the severity of these issues to be in the Important severity range with a maximum CVSSv3 base score of 7.8.

A malicious actor with local access can escalate privileges to ‘root’. 

To remediate CVE-2022-31660 and CVE-2022-31661 apply the patches listed in the ‘Fixed Version’ column of the ‘Resolution Matrix’ found below.

None.

A supplemental blog post was created for additional clarification. Please see: https://via.vmw.com/vmsa-2022-0021-questions-answers-faq

None.

VMware would like to thank Spencer McIntyre of Rapid7 for reporting these issues to us.

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.8.

A malicious actor with local access can escalate privileges to ‘root’. 

To remediate CVE-2022-31664, apply the patches listed in the ‘Fixed Version’ column of the ‘Resolution Matrix’ found below.

None.

A supplemental blog post was created for additional clarification. Please see: https://via.vmw.com/vmsa-2022-0021-questions-answers-faq

None.

VMware would like to thank Steven Seeley (mr_me) of Qihoo 360 Vulnerability Research Institute for reporting this issue to us.

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.6.

A malicious actor with administrator and network access can trigger a remote code execution. 

To remediate CVE-2022-31665, apply the patches listed in the ‘Fixed Version’ column of the ‘Resolution Matrix’ found below.

None.

A supplemental blog post was created for additional clarification. Please see: https://via.vmw.com/vmsa-2022-0021-questions-answers-faq

None.

VMware would like to thank Steven Seeley (mr_me) of Qihoo 360 Vulnerability Research Institute for reporting this issue to us.

VMware Workspace ONE Access and Identity Manager contain a URL injection vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.9.

A malicious actor with network access may be able to redirect an authenticated user to an arbitrary domain.

To remediate CVE-2022-31657, apply the patches listed in the ‘Fixed Version’ column of the ‘Resolution Matrix’ found below.

None.

A supplemental blog post was created for additional clarification. Please see: https://via.vmw.com/vmsa-2022-0021-questions-answers-faq

None.

VMware would like to thank Tom Tervoort of Secura for reporting this issue to us.

VMware Workspace ONE Access, Identity Manager, Connectors and vRealize Automation contain a path traversal vulnerability. VMware has evaluated the severity of this issues to be in the Moderate severity range with a maximum CVSSv3 base score of 5.3.

A malicious actor with network access may be able to access arbitrary files. 

To remediate CVE-2022-31662, apply the patches listed in the ‘Fixed Version’ column of the ‘Resolution Matrix’ found below.

None.

A supplemental blog post was created for additional clarification. Please see: https://via.vmw.com/vmsa-2022-0021-questions-answers-faq

None.

VMware would like to thank PetrusViet (a member of VNG Security) for reporting this issue to us.

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a reflected cross-site scripting (XSS) vulnerability. VMware has evaluated the severity of this issues to be in the Moderate severity range with a maximum CVSSv3 base score of 4.7.

Due to improper user input sanitization, a malicious actor with some user interaction may be able to inject javascript code in the target user’s window.

To remediate CVE-2022-31663, apply the patches listed in the ‘Fixed Version’ column of the ‘Resolution Matrix’ found below.

None.

A supplemental blog post was created for additional clarification. Please see: https://via.vmw.com/vmsa-2022-0021-questions-answers-faq

None.

VMware would like to thank PetrusViet (a member of VNG Security) for reporting this issue to us.

Fixed Version(s): https://kb.vmware.com/s/article/89096
Workarounds: https://kb.vmware.com/s/article/89084

Mitre CVE Dictionary Links:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31656
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31657
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31658
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31659
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31660
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31661
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31662
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31663
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31664
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31665

FIRST CVSSv3 Calculator:
CVE-2022-31656: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-31657: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
CVE-2022-31658: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVE-2022-31659: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVE-2022-31660: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-31661: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-31662: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVE-2022-31663: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
CVE-2022-31664: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-31665: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N

2022-08-02: VMSA-2022-0021
Initial security advisory.

E-mail list for product security notifications and announcements:

https://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce 

This Security Advisory is posted to the following lists:  

security-announce@lists.vmware.com  

bugtraq@securityfocus.com  

fulldisclosure@seclists.org 

E-mail: security@vmware.com

PGP key at:

https://kb.vmware.com/kb/1055 

VMware Security Advisories

https://www.vmware.com/security/advisories 

VMware Security Response Policy

https://www.vmware.com/support/policies/security_response.html 

VMware Lifecycle Support Phases

https://www.vmware.com/support/policies/lifecycle.html 

VMware Security & Compliance Blog  

https://blogs.vmware.com/security 

Twitter

https://twitter.com/VMwareSRC

Copyright 2022 VMware Inc. All rights reserved.