Permissions, Privileges, and Access Controls in VMware Workspace One Access - CVE-2022-31664

Vulnerability identifier: #VU65990

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-31664

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper privilege management. A local user can execute arbitrary code with root privileges.

VMware Workspace One Access
VMware Identity Manager
Aria Automation (formerly vRealize Automation)
Cloud Foundation
vRealize Suite Lifecycle Manager
Dell Enterprise Hybrid Cloud

Install updates from vendor's website.

Dell Enterprise Hybrid Cloud - update to 4.1.2

• https://www.vmware.com/security/advisories/VMSA-2022-0021.html
• https://kb.vmware.com/s/article/89096

• Multiple vulnerabilities in VMware Workspace ONE Access
• Multiple vulnerabilities in VMware Identity Manager (vIDM)
• Multiple vulnerabilities in VMware vRealize Automation
• Multiple vulnerabilities in VMware Cloud Foundation (vIDM)
• Multiple vulnerabilities in vRealize Suite Lifecycle Manager
• Multiple vulnerabilities in Dell Enterprise Hybrid Cloud