PT-2022-2187 · Vmware · Vmware Cloud Foundation+4
Mr_Me
+1
·
Published
2022-01-10
·
Updated
2023-08-08
·
CVE-2022-22958
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
VMware Workspace ONE Access (affected versions not specified)
VMware vRealize Automation (affected versions not specified)
VMware Identity Manager (vIDM) (affected versions not specified)
VMware Cloud Foundation (affected versions not specified)
vRealize Suite Lifecycle Manager (affected versions not specified)
Description
The issue is related to deficiencies in the deserialization mechanism of the affected VMware products. Exploitation of this issue may allow a remote attacker to execute arbitrary code by transmitting specially crafted data through a JDBC URI.
Recommendations
For VMware Workspace ONE Access, consider restricting access to the deserialization mechanism until a patch is available.
For VMware vRealize Automation, restrict access to the vulnerable components to minimize the risk of exploitation.
For VMware Identity Manager (vIDM), avoid using the deserialization mechanism in the administration console until the issue is resolved.
For VMware Cloud Foundation, consider disabling the vulnerable features related to deserialization as a temporary workaround.
For vRealize Suite Lifecycle Manager, restrict the use of the deserialization mechanism in the lifecycle management process until a fix is provided.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Vmware Cloud Foundation
Vmware Identity Manager
Vmware Workspace One Access
Vmware Vrealize Automation
Vrealize Suite Lifecycle Manager