VMware · Multiple Products
CVE-2022-22960
VMware Multiple Products Privilege Escalation Vulnerability
What it is
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor with local access can escalate privileges to 'root'.
CISA: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 6, 2022
- Added to the CISA list
- April 15, 2022
- Published
- April 13, 2022
- Severity
- High 7.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 36% in the top 1.6% of all known vulnerabilities
- Weakness
- CWE-250
- More details
- NVD · CVE.org · CISA
All references (4)
- https://www.vmware.com/security/advisories/VMSA-2022-0011.html
- http://packetstormsecurity.com/files/171918/Mware-Workspace-ONE-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/171918/VMware-Workspace-ONE-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/171935/VMware-Workspace-ONE-Access-Privilege-Escalation.html
More exploited flaws from VMware
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Nov 3, 2021 | Privilege Escalation | Multiple Products | High 7.8 | 7.3% |
| Nov 3, 2021 | Multiple VMware Products Command Injection | Multiple Products | Critical 9.1 | 17% |
| Mar 4, 2025 | TOCTOU Race Condition | ESXi and Workstation | Critical 9.3 | 1.6% |
| Mar 4, 2025 | Arbitrary Write | ESXi | High 8.2 | 1.0% |
| Mar 4, 2025 | Information Disclosure | ESXi, Workstation, and Fusion | High 7.1 | 1.6% |
| Nov 20, 2024 | Heap-Based Buffer Overflow | vCenter Server | Critical 9.8 | 55% |
| Nov 20, 2024 | Privilege Escalation | vCenter Server | High 7.5 | 17% |
| Jul 30, 2024 | Authentication Bypass | ESXi | Medium 6.8 | 27% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.