VMware vRealize Automation vulnerabilities

20 CVEs affecting VMware vRealize Automation, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-20855, published 2023-02-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-22954: VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability, published 2022-04-11. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-04-14. EPSS: 100% chance of exploitation in the next 30 days. VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side…
CVE-2022-22960: VMware Multiple Products Privilege Escalation Vulnerability, published 2022-04-13. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-04-15. EPSS: 35.5% chance of exploitation in the next 30 days. VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor with local access…
CVE-2022-22972, published 2022-05-20. Critical severity, CVSS 9.8. EPSS: 56.3% chance of exploitation in the next 30 days. VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may…
CVE-2022-22956, published 2022-04-13. Critical severity, CVSS 9.8. EPSS: 49.5% chance of exploitation in the next 30 days. VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may bypass the authentication mechanism and…
CVE-2022-22957, published 2022-04-13. High severity, CVSS 7.2. EPSS: 23.3% chance of exploitation in the next 30 days. VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A malicious actor with administrative access…
CVE-2017-4947, published 2018-01-29. Critical severity, CVSS 9.8. EPSS: 8.6% chance of exploitation in the next 30 days. VMware vRealize Automation (7.3 and 7.2) and vSphere Integrated Containers (1.x before 1.3) contain a deserialization vulnerability via Xenon. Successful exploitation of this issue may allow remote…
CVE-2022-22955, published 2022-04-13. Critical severity, CVSS 9.8. EPSS: 7.8% chance of exploitation in the next 30 days. VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may bypass the authentication mechanism and…
CVE-2022-22958, published 2022-04-13. High severity, CVSS 7.2. EPSS: 3.1% chance of exploitation in the next 30 days. VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A malicious actor with administrative access…
CVE-2016-5336, published 2016-08-31. Critical severity, CVSS 9.8. EPSS: 2.9% chance of exploitation in the next 30 days. VMware vRealize Automation 7.0.x before 7.1 allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2016-7460, published 2016-12-29. Critical severity, CVSS 9.1. EPSS: 2.1% chance of exploitation in the next 30 days. The Single Sign-On feature in VMware vCenter Server 5.5 before U3e and 6.0 before U2a and vRealize Automation 6.x before 6.2.5 allows remote attackers to read arbitrary files or cause a denial of…

Latest

CVE-2023-20855, published 2023-02-22. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. A malicious actor, with non-administrative access to vRealize Orchestrator, may be able to use specially crafted…
CVE-2022-22961, published 2022-04-13. Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days. VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an information disclosure vulnerability due to returning excess information. A malicious actor with remote access may…
CVE-2022-22959, published 2022-04-13. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a cross site request forgery vulnerability. A malicious actor can trick a user through a cross site request forgery to…