CVE-2022-22956

Published: Apr 13, 2022Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may bypass the authentication mechanism and execute any operation due to exposed endpoints in the authentication framework.

Affected (10)

Products: Vmware: Identity Manager, Vrealize Automation, Workspace One Access

3 products

Configuration A

10 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Vmware Identity Manager	Version 3.3.3
Vmware Identity Manager	Version 3.3.4
Vmware Identity Manager	Version 3.3.5
Vmware Identity Manager	Version 3.3.6
Vmware Vrealize Automation	From 8.0 to 9.0
Vmware Vrealize Automation	Version 7.6
Vmware Workspace One Access	Version 20.10.0.0
Vmware Workspace One Access	Version 20.10.0.1
Vmware Workspace One Access	Version 21.08.0.0
Vmware Workspace One Access	Version 21.08.0.1