CVE-2022-31656

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Aug 5, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-316579.8VMware Workspace ONE Access and Identity Manager contain a URL injection vulnerability. A malicious actor with network access may be able to CVE-2022-316587.2VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. A malicious actor with CVE-2022-316597.2VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability. A malicious actor with administrator and net CVE-2022-31667.5Rockwell Automation was made aware that the webservers of the Micrologix 1100 and 1400 controllers contain a vulnerability that may lead to CVE-2022-316607.8VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a privilege escalation vulnerability. A malicious actor with CVE-2022-316617.8VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two privilege escalation vulnerabilities. A malicious actor wi CVE-2022-316627.5VMware Workspace ONE Access, Identity Manager, Connectors and vRealize Automation contain a path traversal vulnerability. A malicious actor CVE-2022-316636.1VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a reflected cross-site scripting (XSS) vulnerability. Due to i CVE-2022-316647.8VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability. A malicious actor with l CVE-2022-316657.2VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. A malicious actor with CVE-2022-316665.4Harbor fails to validate user permissions while deleting Webhook policies, allowing malicious users to view, update and delete Webhook polic CVE-2022-316676.4Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t ha