CVE-2022-22972

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users

published May 20, 2022

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.1th percentile for exploit probability.

CVSS
โ€”
EPSS
56%
Percentile
99.1
In the wild
Unconfirmed
What it is

โš ๏ธ A sneaky authentication bypass is lurking in VMware Workspace ONE Access and vRealize Automation! With just network access to the UI, an attacker could waltz into admin territory like they own the place. ๐Ÿ˜ฒ Think of it as a hotel where anyone with a keycard can access the secure admin lounge without having the right credentials โ€” a recipe for chaos! This vulnerability puts your entire system at risk, allowing attackers to gain administrative access without any authentication. They could configure settings, access sensitive data, or even disrupt services, turning your secure environment upside down!

Put simply

Think of it as a hotel where anyone with a keycard can access the secure admin lounge without having the right credentials โ€” a recipe for chaos! The authentication bypass vulnerability affects local domain users in VMware products, enabling malicious actors to obtain administrative access simply by accessing the user interface without proper authentication.

What to do

This vulnerability puts your entire system at risk, allowing attackers to gain administrative access without any authentication. They could configure settings, access sensitive data, or even disrupt services, turning your secure environment upside down! To protect your environment, ensure you apply the latest patches from VMware immediately. Review your access controls and monitor any unusual activity to catch any bad actors before they can cause harm! You've got this! By taking these steps, you can secure your systems and maintain your hero status in cybersecurity! ๐Ÿ›ก๏ธ

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.56305 ยท 99.1th percentile
Published
2022-05-20T20:18Z
EPSS history
Timeline
  • 20 MAY 20:18Z
    VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users
    cvelistv5