One Article Review
| Source |  Fortinet ThreatSignal |
|---|---|
| Identifiant | 4452139 |
| Date de publication | 2022-04-14 16:36:20 (vue: 2022-04-15 00:05:35) |
| Titre | Newly Patched VMware Vulnerability (CVE-2022-22954) Being Exploited in the Wild |
| Texte | FortiGuard Labs is aware that VMware has confirmed a recently patched critical vulnerability in VMware Workspace ONE Access and Identity Manager (CVE-2022-22954) has been exploited in the wild. Also, a Proof-of-Concept (PoC) code has already been made available to the public. An attacker with network access can trigger a server-side template injection that may result in remote code execution.Why is this Significant?This is significant because of the critical remote code execution vulnerability affecting Workspace ONE Access and VMware Identity Manager (vIDM) that are widely used. Since VMware has acknowledged in-the-wild exploitation of CVE-2022-22954 and a POC is available to the public, attacks that leverage the vulnerability will likely increase.What is CVE-2022-22954?CVE-2022-22954 is a vulnerability in Workspace ONE Access and VMware Identity Manager (vIDM), which an attacker with network access can trigger a server-side template injection that may result in remote code execution. The vulnerability has the CVSSv3 base score of 9.8 and is rated critical.Is the Vulnerability Exploited in the Wild?VMware has confirmed that exploitation of CVE-2022-22954 has occurred in the wild.Has the Vendor Released Security Advisories for CVE-2022-22954?Yes, VMware released a security advisory for the vulnerability on April 6th, 2022. See the Appendix for a link to "VMSA-2022-0011".The advisory was updated further on April 13th, 2022 for the confirmation of the in-the-wild exploitation. Has the Vendor Released a Patch for CVE-2022-22954?Yes, VMware released a patch on April 6th, 2022 as part of its security advisory. See the Appendix for a link to "VMSA-2022-0011". What is the Status of Coverage?FortiGuard Labs has released the following IPS signature for CVE-2022-22954 in version 20.297:VMware.Workspace.ONE.Access.Catalog.Remote.Code.Execution (default action is set to pass)What Mitigation Steps are Available?VMware has released a KB article that includes the workaround. See the Appendix for a link to "HW-154129 - Workaround instructions to address CVE-2022-22954, CVE-2022-22955, CVE-2022-22956, CVE-2022-22957, CVE-2022-22958, CVE-2022-22959, CVE-2022-22960 in Workspace ONE Access Appliance (VMware Identity Manager) (88098)". |
| Envoyé | Oui |
| Condensat | 0011 13th 154129 2022 22954 22955 22956 22957 22958 22959 22960 297:vmware 6th 88098 access acknowledged action address advisories advisory affecting already also appendix appliance april are article attacker attacks available aware base because been being can catalog code concept confirmation confirmed coverage critical cve cvssv3 default execution exploitation exploited following fortiguard further has identity includes increase injection instructions ips its labs leverage likely link made manager may mitigation network newly occurred one part pass patch patched poc proof public rated recently released remote result score security see server set side signature significant since status steps template trigger updated used vendor version vidm vmsa vmware vulnerability what which why widely wild will workaround workspace |
| Tags | Vulnerability |
| Stories | |
| Notes | ★★★ |
| Move | 
|
L'article ne semble pas avoir été repris aprés sa publication.
L'article ne semble pas avoir été repris sur un précédent.