Cyber Resilience

CVE-2022-22955

Critical

Published: 13 April 2022

Published
13 April 2022
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.7011 98.7th percentile
Risk Priority 62 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-22955 is a critical-severity an unspecified weakness vulnerability in Vmware Identity Manager. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 1.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

VMware Workspace ONE Access contains an authentication bypass vulnerability, CVE-2022-22955, in its OAuth2 ACS framework. Exposed endpoints allow a remote attacker to circumvent authentication controls entirely and perform arbitrary operations on the affected system. The flaw is rated 9.8 under CVSS 3.1, reflecting network-accessible attack vectors that require neither credentials nor user interaction.

An unauthenticated attacker can exploit the issue over the network to bypass authentication mechanisms and execute any operation permitted by the framework. This grants complete confidentiality, integrity, and availability impact on the Workspace ONE Access instance.

VMware has published advisory VMSA-2022-0011 to address the vulnerability. The current EPSS score of 0.7011 indicates substantial exploitation interest following disclosure.

EU & UK References

Vulnerability details

VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may bypass the authentication mechanism and execute any operation due to exposed endpoints in the authentication framework.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

vmware
identity manager
3.3.3, 3.3.4, 3.3.5, 3.3.6
vmware
vrealize automation
7.6 · 8.0 — 9.0
vmware
workspace one access
20.10.0.0, 20.10.0.1, 21.08.0.0, 21.08.0.1

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References