{"id":46092,"date":"2022-04-07T21:06:00","date_gmt":"2022-04-07T21:06:00","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/5-vmware-products-need-patching-against-serious-security-vulnerabilities\/"},"modified":"2022-04-07T21:06:00","modified_gmt":"2022-04-07T21:06:00","slug":"5-vmware-products-need-patching-against-serious-security-vulnerabilities","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/5-vmware-products-need-patching-against-serious-security-vulnerabilities\/","title":{"rendered":"5 VMware products need patching against serious security vulnerabilities"},"content":{"rendered":"
<\/div>\n

Virtualization and cloud vendor VMware this week disclosed eight vulnerabilities in five of its products<\/a>, and urged users of Workspace ONE Access<\/a> and all its products that include VMware Identity Manager components to patch immediately.<\/p>\n

Three of those vulnerabilities were rated critical on the CVSSv3 scale\u2014two of them contain the possibility for remote code execution, while the third would allow a bad actor to bypass VMware\u2019s user authentication systems to execute unauthorized operations.<\/p>\n

One critical vulnerability, CVE-2022-22954, centers on server-side template injection in Workspace ONE Access and Identity Manager as a possible method of achieving remote code execution, and requires only access to the network on which the services are running.<\/p>\n

Another remote code execution vulnerability in Workspace ONE Access, Identity Manager and vRealize Automation, reported as both CVE-2022-22957 and CVE-2022-22958, would let a bad actor with administrative access control those systems via a malicious Java Database Connectivity URI. The user-authentication bypass, tagged as CVE-2022-22955 and CVE-2022-22956, works by exploiting exposed endpoints in the authentication framework in Workspace ONE Access.<\/p>\n

According to Ian McShane, vice president of strategy at cybersecurity vendor Arctic Wolf, these vulnerabilities are serious indeed, and underlined the urgency of applying patches to the most critical security holes.<\/p>\n

\u201cWith any company, change control should be a best practice,\u201d he said. \u201cBut [the critical security flaws] require immediate changes, and are the ones that should be pushed out without testing.\u201d<\/p>\n