Hackers going after VMware Workspace ONE Access and VMware Identity Manager; patch now

Hackers are trying to take advantage of a recently discovered critical vulnerability in VMware Workspace ONE Access and VMware Identity Manager, adding to the pressure to install patches for this as soon as possible.

The Bleeping Computer news site quotes security researchers saying a proof-of-concept exploit has been released online for the VMware CVE-2022-22954 remote code execution vulnerability. That proof of concept could be used by threat actors as the basis for an attack.

Separately, active attacks are already being seen that successfully infect Workspace ONE Access and VMware Identity Manager servers with coin miners.

VMware disclosed the vulnerability on April 6, along with bugs in other products.

CVE-2022-22954 is a server-side template injection remote code execution vulnerability. VMware rated it in the Critical severity range with a score under the Common Vulnerability Scoring System (CVSSv3) of 9.8.

VMware has issued patches for Workspace ONE Access versions 21.08.x and 20.10.x, and for Identity Manager versions 3.3.x. They all run on Linux.

The only way to remove the vulnerabilities from your environment is to apply the patches provided in VMware’s alert (VMSA-2021-0011) on this bug, the company said. “Workarounds, while convenient, do not remove the vulnerabilities, and may introduce additional complexities that patching would not.”

Organizations that practice change management using the ITIL definitions of change types would consider this an “emergency change,” VMware added. All environments are different, have different tolerance for risk, and have different security controls and defense-in-depth to mitigate risk, so customers must make their own decisions on how to proceed. “However, given the severity of the vulnerability, we strongly recommend immediate action.”

Would you recommend this article?

Share

Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.


Jim Love, Chief Content Officer, IT World Canada

Featured Download

Howard Solomon
Howard Solomon
Currently a freelance writer, I'm the former editor of ITWorldCanada.com and Computing Canada. An IT journalist since 1997, I've written for several of ITWC's sister publications including ITBusiness.ca and Computer Dealer News. Before that I was a staff reporter at the Calgary Herald and the Brampton (Ont.) Daily Times. I can be reached at hsolomon [@] soloreporter.com

Related Tech News

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.