Hackers going after VMware Workspace ONE Access and VMware Identity Manager; patch now

Share post:

Hackers are trying to take advantage of a recently discovered critical vulnerability in VMware Workspace ONE Access and VMware Identity Manager, adding to the pressure to install patches for this as soon as possible. The Bleeping Computer news site quotes security researchers saying a proof-of-concept exploit has been released online for the VMware CVE-2022-22954 remote code execution vulnerability. That proof of concept could be used by threat actors as the basis for an attack. Separately, active attacks are already being seen that successfully infect Workspace ONE Access and VMware Identity Manager servers with coin miners. VMware disclosed the vulnerability on April 6, along with bugs in other products. CVE-2022-22954 is a server-side template injection remote code execution vulnerability. VMware rated it in the Critical severity range with a score under the Common Vulnerability Scoring System (CVSSv3) of 9.8. VMware has issued patches for Workspace ONE Access versions 21.08.x and 20.10.x, and for Identity Manager versions 3.3.x. They all run on Linux. The only way to remove the vulnerabilities from your environment is to apply the patches provided in VMware’s alert (VMSA-2021-0011) on this bug, the company said. “Workarounds, while convenient, do not remove the vulnerabilities, and may introduce additional complexities that patching would not.” Organizations that practice change management using the ITIL definitions of change types would consider this an “emergency change,” VMware added. All environments are different, have different tolerance for risk, and have different security controls and defense-in-depth to mitigate risk, so customers must make their own decisions on how to proceed. “However, given the severity of the vulnerability, we strongly recommend immediate action.” The post Hackers going after VMware Workspace ONE Access and VMware Identity Manager; patch now first appeared on IT World Canada.
Howard Solomon
Howard Solomonhttps://www.itworldcanada.com
Currently a freelance writer, I'm the former editor of ITWorldCanada.com and Computing Canada. An IT journalist since 1997, I've written for ITBusiness.ca and Computer Dealer News. Before that I was a staff reporter at the Calgary Herald and the Brampton (Ont.) Daily Times.

SUBSCRIBE NOW

Related articles

Cyber Security Today, Week in Review for week ending Friday, June 21, 2024

Welcome to Cyber Security Today. This is the Week in Review edition for the week ending Friday June...

Cyber Security Today, June 21, 2024 – US to ban Kaspersky for businesses, consumers

U.S. to ban the sale of Kaspersky products to consumers and businesses. Welcome to Cyber Security Today. It's Friday...

Biden administration to ban US sales of Kaspersky software over ties to Russia

The Biden administration is set to announce a ban on the sale of Kaspersky Lab's antivirus software in...

Security bug may allow anyone to spoof Microsoft employee emails

A security researcher claims to have discovered a bug that enables anyone to impersonate Microsoft corporate email accounts,...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways