« Volver al listado

CVE-2022-31657

Estado: ModificadaCrítica (9.8)—

VMware Workspace ONE Access and Identity Manager contain a URL injection vulnerability. A malicious actor with network access may be able to redirect an authenticated user to an arbitrary domain.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Vmware — Access ConnectorVmware — Identity ManagerVmware — Identity Manager ConnectorVmware — ONE Access

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-31657",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "VMware Workspace ONE Access, Identity Manager and vRealize Automation",
          "versions": [
            {
              "status": "affected",
              "version": "Workspace One Access (21.08.0.1 & 21.08.0.0), Identity Manager (vIDM) (3.3.6, 3.3.5 & 3.3.4), and vRealize Automation 7.6"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-08-05T16:15:12.653",
  "references": [
    {
      "url": "https://www.vmware.com/security/advisories/VMSA-2022-0021.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "https://www.vmware.com/security/advisories/VMSA-2022-0021.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "VMware Workspace ONE Access and Identity Manager contain a URL injection vulnerability. A malicious actor with network access may be able to redirect an authenticated user to an arbitrary domain."
    },
    {
      "lang": "es",
      "value": "VMware Workspace ONE Access y Identity Manager contienen una vulnerabilidad de inyección de URL. Un actor malicioso con acceso a la red puede ser capaz de redirigir a un usuario autenticado a un dominio arbitrario"
    }
  ],
  "lastModified": "2026-06-17T04:45:59.260",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:identity_manager:3.3.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0E93CB5E-CB4A-474A-9901-2E098928C489"
            },
            {
              "criteria": "cpe:2.3:a:vmware:identity_manager:3.3.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2A215A7D-F644-41DE-AB4E-69145DA48F9F"
            },
            {
              "criteria": "cpe:2.3:a:vmware:identity_manager:3.3.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5EBB8190-2101-4EE5-844E-B46E7FB78FD7"
            },
            {
              "criteria": "cpe:2.3:a:vmware:one_access:21.08.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8189EEC2-261B-4095-B4AD-9094CEAB41C9"
            },
            {
              "criteria": "cpe:2.3:a:vmware:one_access:21.08.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E3478B3B-AB6D-4D8F-BB82-E0AC211B0D77"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:access_connector:21.08.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5742FBFE-0E10-4758-BDE0-230F26DFF425"
            },
            {
              "criteria": "cpe:2.3:a:vmware:access_connector:21.08.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "03FEA521-8812-47F0-96FC-C0DD93D5C5F4"
            },
            {
              "criteria": "cpe:2.3:a:vmware:access_connector:22.05:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B9167129-35D9-47FA-B442-F44108356FE4"
            },
            {
              "criteria": "cpe:2.3:a:vmware:identity_manager_connector:3.3.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BC3385CD-5F3E-4076-89A8-37F61FE41270"
            },
            {
              "criteria": "cpe:2.3:a:vmware:identity_manager_connector:3.3.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A2D301BA-B4AA-4DCF-A91E-B03AE5E95AAE"
            },
            {
              "criteria": "cpe:2.3:a:vmware:identity_manager_connector:3.3.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "004A7497-2D06-4D8D-9C82-C0D774101326"
            },
            {
              "criteria": "cpe:2.3:a:vmware:identity_manager_connector:19.03.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "99AA692E-48AB-4813-809C-970CA1BC6AF6"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "security@vmware.com"
}