critical9.8
CVE-2022-22955
VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework.
Impact
VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may bypass the authentication mechanism and execute any operation due to exposed endpoints in the authentication framework.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vmware | Identity Manager | Versions 3.3.3, 3.3.4, 3.3.5, 3.3.6 |
| Vmware | Vrealize Automation | from 8.0 before 9.0 Version 7.6 |
| Vmware | Workspace One Access | Versions 20.10.0.0, 20.10.0.1, 21.08.0.0, 21.08.0.1 |