CVE-2022-22956

Published: Apr 13, 2022Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may bypass the authentication mechanism and execute any operation due to exposed endpoints in the authentication framework.

Affected (10)

Products: Vmware: Identity Manager, Vrealize Automation, Workspace One Access

3 products

Configuration A

10 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Vmware Identity Manager	Version 3.3.3
Vmware Identity Manager	Version 3.3.4
Vmware Identity Manager	Version 3.3.5
Vmware Identity Manager	Version 3.3.6
Vmware Vrealize Automation	8.0 ≤ version < 9.0
Vmware Vrealize Automation	Version 7.6
Vmware Workspace One Access	Version 20.10.0.0
Vmware Workspace One Access	Version 20.10.0.1
Vmware Workspace One Access	Version 21.08.0.0
Vmware Workspace One Access	Version 21.08.0.1