CVE-2022-22959 - Vulnerability Details

Vendors	Products
Linux	Linux Kernel
Vmware	Cloud Foundation Identity Manager Vrealize Automation Vrealize Suite Lifecycle Manager Workspace One Access

Link	Providers
https://www.vmware.com/security/advisories/VMSA-2022-0011.html

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "VMware Workspace ONE Access, Identity Manager and vRealize Automation", "vendor": "n/a", "versions": [{"status": "affected", "version": "Access 21.08.0.1, 21.08.0.0, 20.10.0.1, 20.10.0.0. Identity Manager 3.3.6, 3.3.5, 3.3.4, 3.3.3. vRealize Automation 7.6."}]}], "descriptions": [{"lang": "en", "value": "VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a cross site request forgery vulnerability. A malicious actor can trick a user through a cross site request forgery to unintentionally validate a malicious JDBC URI."}], "problemTypes": [{"descriptions": [{"description": "Cross site request forgery", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-04-13T17:05:54", "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.vmware.com/security/advisories/VMSA-2022-0011.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@vmware.com", "ID": "CVE-2022-22959", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "VMware Workspace ONE Access, Identity Manager and vRealize Automation", "version": {"version_data": [{"version_value": "Access 21.08.0.1, 21.08.0.0, 20.10.0.1, 20.10.0.0. Identity Manager 3.3.6, 3.3.5, 3.3.4, 3.3.3. vRealize Automation 7.6."}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a cross site request forgery vulnerability. A malicious actor can trick a user through a cross site request forgery to unintentionally validate a malicious JDBC URI."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Cross site request forgery"}]}]}, "references": {"reference_data": [{"name": "https://www.vmware.com/security/advisories/VMSA-2022-0011.html", "refsource": "MISC", "url": "https://www.vmware.com/security/advisories/VMSA-2022-0011.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T03:28:42.618Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.vmware.com/security/advisories/VMSA-2022-0011.html"}]}]}, "cveMetadata": {"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "assignerShortName": "vmware", "cveId": "CVE-2022-22959", "datePublished": "2022-04-13T17:05:54", "dateReserved": "2022-01-10T00:00:00", "dateUpdated": "2024-08-03T03:28:42.618Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : VMware Workspace ONE Access, Identity Manager and vRealize Automation (string)

vendor : n/a (string)

versions : [ »

0 : { »

status : affected (string)

version : Access 21.08.0.1, 21.08.0.0, 20.10.0.1, 20.10.0.0. Identity Manager 3.3.6, 3.3.5, 3.3.4, 3.3.3. vRealize Automation 7.6. (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a cross site request forgery vulnerability. A malicious actor can trick a user through a cross site request forgery to unintentionally validate a malicious JDBC URI. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : Cross site request forgery (string)

lang : en (string)

type : text (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2022-04-13T17:05:54 (string)

orgId : dcf2e128-44bd-42ed-91e8-88f912c1401d (string)

shortName : vmware (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://www.vmware.com/security/advisories/VMSA-2022-0011.html (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : security@vmware.com (string)

ID : CVE-2022-22959 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : VMware Workspace ONE Access, Identity Manager and vRealize Automation (string)

version : { »

version_data : [ »

0 : { »

version_value : Access 21.08.0.1, 21.08.0.0, 20.10.0.1, 20.10.0.0. Identity Manager 3.3.6, 3.3.5, 3.3.4, 3.3.3. vRealize Automation 7.6. (string)

}

]

}

]

}

vendor_name : n/a (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a cross site request forgery vulnerability. A malicious actor can trick a user through a cross site request forgery to unintentionally validate a malicious JDBC URI. (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : Cross site request forgery (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://www.vmware.com/security/advisories/VMSA-2022-0011.html (string)

refsource : MISC (string)

url : https://www.vmware.com/security/advisories/VMSA-2022-0011.html (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T03:28:42.618Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

1 : x_transferred (string)

]

url : https://www.vmware.com/security/advisories/VMSA-2022-0011.html (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : dcf2e128-44bd-42ed-91e8-88f912c1401d (string)

assignerShortName : vmware (string)

cveId : CVE-2022-22959 (string)

datePublished : 2022-04-13T17:05:54 (string)

dateReserved : 2022-01-10T00:00:00 (string)

dateUpdated : 2024-08-03T03:28:42.618Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*", "matchCriteriaId": "5071E0B4-FE4B-4525-BAF6-3900D9C8D48D", "versionEndExcluding": "5.0", "versionStartIncluding": "3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:identity_manager:3.3.3:*:*:*:*:*:*:*", "matchCriteriaId": "97D98937-489B-4AA5-B99E-9AB639C582CA", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:identity_manager:3.3.4:*:*:*:*:*:*:*", "matchCriteriaId": "0E93CB5E-CB4A-474A-9901-2E098928C489", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:identity_manager:3.3.5:*:*:*:*:*:*:*", "matchCriteriaId": "2A215A7D-F644-41DE-AB4E-69145DA48F9F", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:identity_manager:3.3.6:*:*:*:*:*:*:*", "matchCriteriaId": "5EBB8190-2101-4EE5-844E-B46E7FB78FD7", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:vrealize_automation:*:*:*:*:*:*:*:*", "matchCriteriaId": "370EF5F6-77E2-4EF7-9148-9DA5C52E50F5", "versionEndExcluding": "9.0", "versionStartIncluding": "8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:vrealize_automation:7.6:*:*:*:*:*:*:*", "matchCriteriaId": "471BB5AF-3744-45FE-937D-BBEC421035EB", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "FC19367B-D2F8-4966-BE2F-12700C9337EC", "versionEndExcluding": "9.0", "versionStartIncluding": "8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:workspace_one_access:20.10.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "639F6029-DE62-49BD-A767-C5D499389C37", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:workspace_one_access:20.10.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "88AD029C-7707-4F1E-BE7F-2DE27D384538", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:workspace_one_access:21.08.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "57375AD7-8042-472F-B49E-653C77EAFA48", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:workspace_one_access:21.08.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "AC3DC465-1FA7-4F5B-9A9A-12F8FB4CE146", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a cross site request forgery vulnerability. A malicious actor can trick a user through a cross site request forgery to unintentionally validate a malicious JDBC URI."}, {"lang": "es", "value": "VMware Workspace ONE Access, Identity Manager y vRealize Automation contienen una vulnerabilidad de tipo cross site request forgery. Un actor malicioso puede enga\u00f1ar a un usuario mediante un ataque de tipo cross site request forgery para que compruebe involuntariamente un URI JDBC malicioso"}], "id": "CVE-2022-22959", "lastModified": "2024-11-21T06:47:41.243", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-04-13T18:15:13.373", "references": [{"source": "security@vmware.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.vmware.com/security/advisories/VMSA-2022-0011.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.vmware.com/security/advisories/VMSA-2022-0011.html"}], "sourceIdentifier": "security@vmware.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 5071E0B4-FE4B-4525-BAF6-3900D9C8D48D (string)

versionEndExcluding : 5.0 (string)

versionStartIncluding : 3.0 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:vmware:identity_manager:3.3.3:*:*:*:*:*:*:* (string)

matchCriteriaId : 97D98937-489B-4AA5-B99E-9AB639C582CA (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:vmware:identity_manager:3.3.4:*:*:*:*:*:*:* (string)

matchCriteriaId : 0E93CB5E-CB4A-474A-9901-2E098928C489 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:vmware:identity_manager:3.3.5:*:*:*:*:*:*:* (string)

matchCriteriaId : 2A215A7D-F644-41DE-AB4E-69145DA48F9F (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:vmware:identity_manager:3.3.6:*:*:*:*:*:*:* (string)

matchCriteriaId : 5EBB8190-2101-4EE5-844E-B46E7FB78FD7 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:vmware:vrealize_automation:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 370EF5F6-77E2-4EF7-9148-9DA5C52E50F5 (string)

versionEndExcluding : 9.0 (string)

versionStartIncluding : 8.0 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:vmware:vrealize_automation:7.6:*:*:*:*:*:*:* (string)

matchCriteriaId : 471BB5AF-3744-45FE-937D-BBEC421035EB (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : FC19367B-D2F8-4966-BE2F-12700C9337EC (string)

versionEndExcluding : 9.0 (string)

versionStartIncluding : 8.0 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:vmware:workspace_one_access:20.10.0.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 639F6029-DE62-49BD-A767-C5D499389C37 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:vmware:workspace_one_access:20.10.0.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 88AD029C-7707-4F1E-BE7F-2DE27D384538 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:vmware:workspace_one_access:21.08.0.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 57375AD7-8042-472F-B49E-653C77EAFA48 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:vmware:workspace_one_access:21.08.0.1:*:*:*:*:*:*:* (string)

matchCriteriaId : AC3DC465-1FA7-4F5B-9A9A-12F8FB4CE146 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 703AF700-7A70-47E2-BC3A-7FD03B3CA9C1 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a cross site request forgery vulnerability. A malicious actor can trick a user through a cross site request forgery to unintentionally validate a malicious JDBC URI. (string)

}

1 : { »

lang : es (string)

value : VMware Workspace ONE Access, Identity Manager y vRealize Automation contienen una vulnerabilidad de tipo cross site request forgery. Un actor malicioso puede engañar a un usuario mediante un ataque de tipo cross site request forgery para que compruebe involuntariamente un URI JDBC malicioso (string)

}

]

id : CVE-2022-22959 (string)

lastModified : 2024-11-21T06:47:41.243 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : MEDIUM (string)

cvssData : { »

accessComplexity : MEDIUM (string)

accessVector : NETWORK (string)

authentication : NONE (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

confidentialityImpact : NONE (string)

integrityImpact : PARTIAL (string)

vectorString : AV:N/AC:M/Au:N/C:N/I:P/A:N (string)

version : 2.0 (string)

}

exploitabilityScore : 8.6 (number)

impactScore : 2.9 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : true (boolean)

}

]

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 1.4 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2022-04-13T18:15:13.373 (string)

references : [ »

0 : { »

source : security@vmware.com (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : https://www.vmware.com/security/advisories/VMSA-2022-0011.html (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : https://www.vmware.com/security/advisories/VMSA-2022-0011.html (string)

}

]

sourceIdentifier : security@vmware.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-352 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object