{"id":20578,"date":"2022-08-10T06:07:33","date_gmt":"2022-08-10T06:07:33","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=20578"},"modified":"2022-08-10T06:07:33","modified_gmt":"2022-08-10T06:07:33","slug":"critical-vmware-product-vulnerability-alerts","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/critical-vmware-product-vulnerability-alerts\/","title":{"rendered":"Critical VMware Product Vulnerability Alerts"},"content":{"rendered":"\n

Overview<\/h2>\n\n\n\n

Recently, NSFOCUS CERT detected that VMware officially issued a security notice to fix multiple vulnerabilities in products such as VMware Workspace ONE Access, Identity Manager, and VMware vRealize Automation. Attackers can use these vulnerabilities to cause privilege escalation and remote code execution. At present, the official security update has been released, and relevant users are requested to take measures to protect them.<\/p>\n\n\n\n

Reference link:<\/p>\n\n\n\n

https:\/\/www.vmware.com\/security\/advisories\/VMSA-2022-0021.html<\/a><\/p>\n\n\n\n

Key Vulnerabilities<\/h2>\n\n\n\n

VMware Authentication Bypass Vulnerability (CVE-2022-31656):<\/strong><\/p>\n\n\n\n

An authentication bypass vulnerability exists in VMware Workspace ONE Access, Identity Manager, and vRealize Automation that affects local domain users. An attacker with network access to the UI could gain administrative access without requiring authentication. The CVSS score is 9.8.<\/p>\n\n\n\n

VMware JDBC Injection Remote Code Execution Vulnerability (CVE-2022-31658\/CVE-2022-31665):<\/strong><\/p>\n\n\n\n

Two remote code execution vulnerabilities exist in VMware Workspace ONE Access, Identity Manager, and vRealize Automation. An attacker with administrator and network access could exploit the vulnerability for remote code execution. The CVSS scores were 8.0 and 7.6, respectively.<\/p>\n\n\n\n

VMware SQL Injection Remote Code Execution Vulnerability (CVE-2022-31659):<\/strong><\/p>\n\n\n\n

A remote code execution vulnerability exists in VMware Workspace ONE Access and Identity Manager. An attacker with administrative and network access rights can exploit this vulnerability to write malicious files through SQL injection and ultimately achieve arbitrary code execution. CVSS score of 8.0.<\/p>\n\n\n\n

VMware Local Privilege Escalation Vulnerability (CVE-2022-31660\/CVE-2022-31661\/CVE-2022-31664):<\/strong><\/p>\n\n\n\n

Two privilege escalation vulnerabilities exist in VMware Workspace ONE Access, Identity Manager, and vRealize Automation. An attacker with local privileges could exploit this vulnerability to escalate privileges to root. CVSS score of 7.8.<\/p>\n\n\n\n

Scope of Impact<\/h2>\n\n\n\n

Affected versions<\/strong><\/p>\n\n\n\n