Permissions, Privileges, and Access Controls in VMware Workspace One Access - CVE-2022-31661

Vulnerability identifier: #VU65987

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-31661

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper privilege management. A local user can execute arbitrary code with root privileges.

VMware Workspace One Access
VMware Identity Manager
Aria Automation (formerly vRealize Automation)
Cloud Foundation
vRealize Suite Lifecycle Manager
Dell Enterprise Hybrid Cloud

Install updates from vendor's website.

Dell Enterprise Hybrid Cloud - update to 4.1.2

• https://www.vmware.com/security/advisories/VMSA-2022-0021.html
• https://kb.vmware.com/s/article/89096

• Multiple vulnerabilities in VMware Workspace ONE Access
• Multiple vulnerabilities in VMware Identity Manager (vIDM)
• Multiple vulnerabilities in VMware vRealize Automation
• Multiple vulnerabilities in VMware Cloud Foundation (vIDM)
• Multiple vulnerabilities in vRealize Suite Lifecycle Manager
• Multiple vulnerabilities in Dell Enterprise Hybrid Cloud