CVE-2022-22944

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

VMware Workspace ONE Boxer contains a stored cross-site scripting (XSS) vulnerability. Due to insufficient sanitization and validation, in VMware Workspace ONE Boxer calendar event descriptions, a malicious actor can inject script tags to execute arbitrary script within a user's window.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
n/aVMware Workspace ONE BoxerVMware Workspace ONE Boxer for iOS prior to 22.02

References

Timeline

Published
Mar 2, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-229457.8VMware NSX Edge contains a CLI shell injection vulnerability. A malicious actor with SSH access to an NSX-Edge appliance can execute arbitraCVE-2022-229465.5In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificatesCVE-2022-2294710.0In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway ActuatCVE-2022-229486.5The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administCVE-2022-22958.8Type confusion in V8 in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a craftedCVE-2022-229506.5n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expCVE-2022-229519.1VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains an OS CVE-2022-229529.1VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains a fileCVE-2022-229536.5VMware HCX update addresses an information disclosure vulnerability. A malicious actor with network user access to the VMware HCX appliance CVE-2022-229549.8VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A maliCVE-2022-229559.8VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A mCVE-2022-229569.8VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A m
CVE-2022-22944: Medium severity, CVSS 5.4 | Vulnix