VMware Identity Manager Connector vulnerabilities

13 CVEs affecting VMware Identity Manager Connector, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-20884, published 2023-05-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-4006: Multiple VMware Products Command Injection Vulnerability, published 2020-11-23. Critical severity, CVSS 9.1. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 17.3% chance of exploitation in the next 30 days. VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability.
CVE-2022-31656, published 2022-08-05. Critical severity, CVSS 9.8. EPSS: 24.3% chance of exploitation in the next 30 days. VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may…
CVE-2022-31659, published 2022-08-05. High severity, CVSS 7.2. EPSS: 2.9% chance of exploitation in the next 30 days. VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability. A malicious actor with administrator and network access can trigger a remote code execution.
CVE-2022-31665, published 2022-08-05. High severity, CVSS 7.2. EPSS: 2.4% chance of exploitation in the next 30 days. VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. A malicious actor with administrator and network access can trigger a remote code…
CVE-2022-31658, published 2022-08-05. High severity, CVSS 7.2. EPSS: 2.2% chance of exploitation in the next 30 days. VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. A malicious actor with administrator and network access can trigger a remote code…
CVE-2022-31657, published 2022-08-05. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. VMware Workspace ONE Access and Identity Manager contain a URL injection vulnerability. A malicious actor with network access may be able to redirect an authenticated user to an arbitrary domain.
CVE-2022-31662, published 2022-08-05. High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days. VMware Workspace ONE Access, Identity Manager, Connectors and vRealize Automation contain a path traversal vulnerability. A malicious actor with network access may be able to access arbitrary files.
CVE-2022-31660, published 2022-08-05. High severity, CVSS 7.8. EPSS: 1.1% chance of exploitation in the next 30 days. VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'.
CVE-2022-31663, published 2022-08-05. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a reflected cross-site scripting (XSS) vulnerability. Due to improper user input sanitization, a malicious actor with…
CVE-2022-31701, published 2022-12-14. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. VMware Workspace ONE Access and Identity Manager contain a broken authentication vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum…

Latest

CVE-2023-20884, published 2023-05-30. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. An unauthenticated malicious actor may be able to redirect a victim to an attacker controlled…
CVE-2022-31664, published 2022-08-05. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'.
CVE-2022-31661, published 2022-08-05. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two privilege escalation vulnerabilities. A malicious actor with local access can escalate privileges to 'root'.