CVE-2022-22955
Published: 13 April 2022
Summary
CVE-2022-22955 is a critical-severity an unspecified weakness vulnerability in Vmware Identity Manager. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
VMware Workspace ONE Access contains an authentication bypass vulnerability, CVE-2022-22955, in its OAuth2 ACS framework. Exposed endpoints allow a remote attacker to circumvent authentication controls entirely and perform arbitrary operations on the affected system. The flaw is rated 9.8 under CVSS 3.1, reflecting network-accessible attack vectors that require neither credentials nor user interaction.
An unauthenticated attacker can exploit the issue over the network to bypass authentication mechanisms and execute any operation permitted by the framework. This grants complete confidentiality, integrity, and availability impact on the Workspace ONE Access instance.
VMware has published advisory VMSA-2022-0011 to address the vulnerability. The current EPSS score of 0.7011 indicates substantial exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-28078
Vulnerability details
VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may bypass the authentication mechanism and execute any operation due to exposed endpoints in the authentication framework.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.