← Back

CVE-2022-22954

nvd nistnuclei
Published: Apr 11, 2022Modified: Oct 30, 2025CISA KEV

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.

Affected (11)

Vmware
5 products
Identity Manager
Vrealize Automation
Workspace One Access
Cloud Foundation
Vrealize Suite Lifecycle Manager
Configuration A
9 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Vmware
Identity Manager
Version 3.3.3
Identity Manager
Version 3.3.4
Identity Manager
Version 3.3.5
Identity Manager
Version 3.3.6
Vrealize Automation
Version 7.6
Vmware
Workspace One Access
Version 20.10.0.0
Workspace One Access
Version 20.10.0.1
Workspace One Access
Version 21.08.0.0
Workspace One Access
Version 21.08.0.1
Running on/withPlatform Versions
Linux
Linux Kernel
All versions
Configuration B
2 vulnerable
Vulnerable SoftwareAffected Versions
Cloud Foundation
From 4.0 to 4.3.1
Vrealize Suite Lifecycle Manager
From 8.0 to 8.2

Related CWEs

CWE-94
Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (5)

Source: security@vmware.com
ExploitThird Party AdvisoryVDB Entry
Source: security@vmware.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource

Timeline

No history available yet.