Hackers going after VMware Workspace ONE Access and VMware Identity Manager; patch now

Share post:

Hackers are trying to take advantage of a recently discovered critical vulnerability in VMware Workspace ONE Access and VMware Identity Manager, adding to the pressure to install patches for this as soon as possible. The Bleeping Computer news site quotes security researchers saying a proof-of-concept exploit has been released online for the VMware CVE-2022-22954 remote code execution vulnerability. That proof of concept could be used by threat actors as the basis for an attack. Separately, active attacks are already being seen that successfully infect Workspace ONE Access and VMware Identity Manager servers with coin miners. VMware disclosed the vulnerability on April 6, along with bugs in other products. CVE-2022-22954 is a server-side template injection remote code execution vulnerability. VMware rated it in the Critical severity range with a score under the Common Vulnerability Scoring System (CVSSv3) of 9.8. VMware has issued patches for Workspace ONE Access versions 21.08.x and 20.10.x, and for Identity Manager versions 3.3.x. They all run on Linux. The only way to remove the vulnerabilities from your environment is to apply the patches provided in VMware’s alert (VMSA-2021-0011) on this bug, the company said. “Workarounds, while convenient, do not remove the vulnerabilities, and may introduce additional complexities that patching would not.” Organizations that practice change management using the ITIL definitions of change types would consider this an “emergency change,” VMware added. All environments are different, have different tolerance for risk, and have different security controls and defense-in-depth to mitigate risk, so customers must make their own decisions on how to proceed. “However, given the severity of the vulnerability, we strongly recommend immediate action.” The post Hackers going after VMware Workspace ONE Access and VMware Identity Manager; patch now first appeared on IT World Canada.
Howard Solomon
Howard Solomon
Currently a freelance writer, I'm the former editor of and Computing Canada. An IT journalist since 1997, I've written for several of ITWC's sister publications including and Computer Dealer News. Before that I was a staff reporter at the Calgary Herald and the Brampton (Ont.) Daily Times.


Related articles

Okta’s login flaw exposes users to attack, says Mitiga

According to Mitiga, Okta's login system contains a simple error that could expose its users to future attacks. Users...

Congress committee chair to TikTok: ‘Your platform should be banned’

In response TikTok CEO says company is building a 'firewall' around American user data against fore

Beware of scammers using AI-generated voice clones, FTC warns

The Federal Trade Commission (FTC) issued a consumer alert warning people to be vigilant for calls using voice...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways