CVE-2022-31658

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. A malicious actor with administrator and network access can trigger a remote code execution.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
n/a	VMware Workspace ONE Access, Identity Manager and vRealize Automation	Workspace One Access (21.08.0.1 & 21.08.0.0), Identity Manager (vIDM) (3.3.6, 3.3.5 & 3.3.4), and vRealize Automation 7.6

References

https://www.vmware.com/security/advisories/VMSA-2022-0021.htmlPatch, Vendor Advisory
https://www.vmware.com/security/advisories/VMSA-2022-0021.htmlPatch, Vendor Advisory

Timeline

Published: Aug 5, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-316597.2VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability. A malicious actor with administrator and net CVE-2022-31667.5Rockwell Automation was made aware that the webservers of the Micrologix 1100 and 1400 controllers contain a vulnerability that may lead to CVE-2022-316607.8VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a privilege escalation vulnerability. A malicious actor with CVE-2022-316617.8VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two privilege escalation vulnerabilities. A malicious actor wi CVE-2022-316627.5VMware Workspace ONE Access, Identity Manager, Connectors and vRealize Automation contain a path traversal vulnerability. A malicious actor CVE-2022-316636.1VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a reflected cross-site scripting (XSS) vulnerability. Due to i CVE-2022-316647.8VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability. A malicious actor with l CVE-2022-316657.2VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. A malicious actor with CVE-2022-316665.4Harbor fails to validate user permissions while deleting Webhook policies, allowing malicious users to view, update and delete Webhook polic CVE-2022-316676.4Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t ha CVE-2022-316687.7Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with a CVE-2022-316697.7Harbor fails to validate the user permissions when updating tag immutability policies. By sending a request to update a tag immutability p