CVE-2022-22960

high · 7.8Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply updates per vendor instructions.

Added 2022-04-15Remediation due 2022-05-06

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor with local access can escalate privileges to 'root'.

7.8

CVSS

35.5%

EPSS (exploit prob.)

98th

EPSS percentile

2022-04-13

Published

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-732

Affected products

Vendor	Product	Affected versions
vmware	cloud_foundation	>= 3.0, < 5.0
vmware	identity_manager	3.3.3
vmware	identity_manager	3.3.4
vmware	identity_manager	3.3.5
vmware	identity_manager	3.3.6
vmware	vrealize_automation	7.6
vmware	vrealize_suite_lifecycle_manager	>= 8.0, < 9.0
vmware	workspace_one_access	20.10.0.0
vmware	workspace_one_access	20.10.0.1
vmware	workspace_one_access	21.08.0.0
vmware	workspace_one_access	21.08.0.1
linux	linux_kernel	all versions

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2022-22960