CVE-2022-31663

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a reflected cross-site scripting (XSS) vulnerability. Due to improper user input sanitization, a malicious actor with some user interaction may be able to inject javascript code in the target user's window.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	VMware Workspace ONE Access, Identity Manager and vRealize Automation	Workspace One Access (21.08.0.1 & 21.08.0.0), Identity Manager (vIDM) (3.3.6, 3.3.5 & 3.3.4), and vRealize Automation 7.6

References

https://www.vmware.com/security/advisories/VMSA-2022-0021.htmlPatch, Vendor Advisory
https://www.vmware.com/security/advisories/VMSA-2022-0021.htmlPatch, Vendor Advisory

Timeline

Published: Aug 5, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-316647.8VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability. A malicious actor with l CVE-2022-316657.2VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. A malicious actor with CVE-2022-316665.4Harbor fails to validate user permissions while deleting Webhook policies, allowing malicious users to view, update and delete Webhook polic CVE-2022-316676.4Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t ha CVE-2022-316687.7Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with a CVE-2022-316697.7Harbor fails to validate the user permissions when updating tag immutability policies. By sending a request to update a tag immutability p CVE-2022-31678.8Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1.CVE-2022-316707.7Harbor fails to validate the user permissions when updating tag retention policies. By sending a request to update a tag retention policy CVE-2022-316717.4Harbor fails to validate user permissions when reading and updating job execution logs through the P2P preheat execution logs. By sending a CVE-2022-316727.2VMware vRealize Operations contains a privilege escalation vulnerability. A malicious actor with administrative network access can escalate CVE-2022-316738.8VMware vRealize Operations contains an information disclosure vulnerability. A low-privileged malicious actor with network access can create CVE-2022-316744.3VMware vRealize Operations contains an information disclosure vulnerability. A low-privileged malicious actor with network access can access