« Volver al listado

CVE-2022-31663

Estado: ModificadaMedia (6.1)—

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a reflected cross-site scripting (XSS) vulnerability. Due to improper user input sanitization, a malicious actor with some user interaction may be able to inject javascript code in the target user's window.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Vmware — Access ConnectorVmware — Identity ManagerVmware — Identity Manager ConnectorVmware — ONE Access

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-31663",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "VMware Workspace ONE Access, Identity Manager and vRealize Automation",
          "versions": [
            {
              "status": "affected",
              "version": "Workspace One Access (21.08.0.1 & 21.08.0.0), Identity Manager (vIDM) (3.3.6, 3.3.5 & 3.3.4), and vRealize Automation 7.6"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-08-05T16:15:12.900",
  "references": [
    {
      "url": "https://www.vmware.com/security/advisories/VMSA-2022-0021.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "https://www.vmware.com/security/advisories/VMSA-2022-0021.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a reflected cross-site scripting (XSS) vulnerability. Due to improper user input sanitization, a malicious actor with some user interaction may be able to inject javascript code in the target user's window."
    },
    {
      "lang": "es",
      "value": "VMware Workspace ONE Access, Identity Manager y vRealize Automation contienen una vulnerabilidad de tipo cross-site scripting (XSS) reflejada. Debido a un saneo inapropiado de la entrada del usuario, un actor malicioso con cierta interacción con el usuario puede ser capaz de inyectar código javascript en la ventana del usuario objetivo"
    }
  ],
  "lastModified": "2026-06-17T04:46:00.010",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:identity_manager:3.3.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0E93CB5E-CB4A-474A-9901-2E098928C489"
            },
            {
              "criteria": "cpe:2.3:a:vmware:identity_manager:3.3.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2A215A7D-F644-41DE-AB4E-69145DA48F9F"
            },
            {
              "criteria": "cpe:2.3:a:vmware:identity_manager:3.3.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5EBB8190-2101-4EE5-844E-B46E7FB78FD7"
            },
            {
              "criteria": "cpe:2.3:a:vmware:one_access:21.08.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8189EEC2-261B-4095-B4AD-9094CEAB41C9"
            },
            {
              "criteria": "cpe:2.3:a:vmware:one_access:21.08.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E3478B3B-AB6D-4D8F-BB82-E0AC211B0D77"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:access_connector:21.08.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5742FBFE-0E10-4758-BDE0-230F26DFF425"
            },
            {
              "criteria": "cpe:2.3:a:vmware:access_connector:21.08.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "03FEA521-8812-47F0-96FC-C0DD93D5C5F4"
            },
            {
              "criteria": "cpe:2.3:a:vmware:access_connector:22.05:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B9167129-35D9-47FA-B442-F44108356FE4"
            },
            {
              "criteria": "cpe:2.3:a:vmware:identity_manager_connector:3.3.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BC3385CD-5F3E-4076-89A8-37F61FE41270"
            },
            {
              "criteria": "cpe:2.3:a:vmware:identity_manager_connector:3.3.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A2D301BA-B4AA-4DCF-A91E-B03AE5E95AAE"
            },
            {
              "criteria": "cpe:2.3:a:vmware:identity_manager_connector:3.3.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "004A7497-2D06-4D8D-9C82-C0D774101326"
            },
            {
              "criteria": "cpe:2.3:a:vmware:identity_manager_connector:19.03.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "99AA692E-48AB-4813-809C-970CA1BC6AF6"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "security@vmware.com"
}