VMware admins asked to patch eight vulnerabilities

By

Authentication bypass, remote code execution, and more.

VMware has patched eight bugs in five of its products that were uncovered by Qihoo 360 security researcher Steven Seeley.

VMware admins asked to patch eight vulnerabilities

An advisory notes the eight vulnerabilities affect five different products: Workspace ONE Access, Identity Manager, vRealize Automation, Cloud Foundation, and vRealize Suite Lifecycle Manager.

Workspace ONE Access is impacted by two critical authentication bypass vulnerabilities, denoted as CVE-2022-22955 and CVE-2022-22956. 

They would allow an attacker to “bypass the authentication mechanism and execute any operation due to exposed endpoints in the authentication framework”, the advisory says.

Workspace ONE Access is also affected by a critical remote code execution vulnerability, CVE-2022-22954.

The vulnerability arises because of server-side template injection, the advisory stated. 

If a malicious attacker triggers the template injection, they can gain remote code execution.

The next pair of critical remote code execution vulnerabilities, CVE-2022-22957 and CVE-2022-22958, affect several products: VMware Workspace ONE Access, Identity Manager and vRealize Automation.

“A malicious actor with administrative access can trigger deserialisation of untrusted data through malicious JDBC (Java database connectivity) URI which may result in remote code execution," the advisory states.

The same three products also suffer a less-severe cross-site request forgery bug, CVE-2022-22959, in which a user could be tricked into validating a malicious JDBC URI.

The final two less-severe bugs are CVE-2022-22960, a local privilege escalation bug; and CVE-2022-22961, an information disclosure vulnerability.

Patches and workarounds are available for all bugs.

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © iTnews.com.au . All rights reserved.
Tags:

Most Read Articles

Woolworths' CSO is Optus-bound

Woolworths' CSO is Optus-bound

Australia's super funds told to assess authentication controls

Australia's super funds told to assess authentication controls

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

The Northern Beaches Women's Shelter hones focus on tech-enabled abuse

The Northern Beaches Women's Shelter hones focus on tech-enabled abuse

Log In

  |  Forgot your password?