CVE-2022-22960 is a privilege escalation vulnerability affecting VMware Workspace ONE Access, Identity Manager, and vRealize Automation, stemming from improper permissions in support scripts. This flaw allows a local attacker to escalate privileges to 'root' with low attack complexity, leading to high impact on confidentiality, integrity, and availability. The vulnerability has a CVSS score of 7.8 (HIGH) and is actively exploited in the wild, with public exploit modules available and significant community discussion. CISA has issued directives for federal agencies to patch this critical vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 3.0, < 5.0CPE matchmatch criteria | cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* | ||
3.3.3CPE matchmatch criteria | cpe:2.3:a:vmware:identity_manager:3.3.3:*:*:*:*:*:*:* | ||
3.3.4CPE matchmatch criteria | cpe:2.3:a:vmware:identity_manager:3.3.4:*:*:*:*:*:*:* | ||
3.3.5CPE matchmatch criteria | cpe:2.3:a:vmware:identity_manager:3.3.5:*:*:*:*:*:*:* | ||
3.3.6CPE matchmatch criteria | cpe:2.3:a:vmware:identity_manager:3.3.6:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.