CVE-2022-22960

披露于 2022/04/13 · 更新于 2025/07/07

CVSS 评分7.8/ 10.0

EPSS 概率77.2%百分位 98.9%

漏洞描述

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor with local access can escalate privileges to 'root'.

影响产品

威睿cloud_foundation查看产品 →威睿identity_manager查看产品 →

修复建议

建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。

参考链接

packetstormsecurity.comhttp://packetstormsecurity.com/files/171935/VMware-Workspace-ONE-Access-Privilege-Escalation.html↗packetstormsecurity.comhttp://packetstormsecurity.com/files/171918/Mware-Workspace-ONE-Remote-Code-Execution.html↗packetstormsecurity.comhttp://packetstormsecurity.com/files/171918/VMware-Workspace-ONE-Remote-Code-Execution.html↗www.vmware.comhttps://www.vmware.com/security/advisories/VMSA-2022-0011.html↗

RELATED INTELLIGENCE

同产品关联漏洞

与 cloud_foundation 相关的其他公开漏洞。

查看全部 →

漏洞与影响对象	风险等级	CVSS	EPSS	利用情报	披露时间
CVE-2022-31678 VMWare Cloud Foundation NSX-V - XML External Entity (XXE) cloud_foundation	严重	—	—	PoCEXP	2026/02/26
CVE-2021-22005RCE VMware vCenter Server - Arbitrary File Upload cloud_foundation	严重	9.8	94.4%	PoCEXP	2021/09/22
CVE-2021-21975RCE vRealize Operations Manager API - Server-Side Request Forgery cloud_foundation	高危	7.5	94.4%	PoCEXP	2021/04/01
CVE-2021-21983 CVE-2021-21983 cloud_foundation	中危	6.5	83.2%	PoCEXP	2021/03/31
CVE-2021-21973 VMware vSphere - Server-Side Request Forgery cloud_foundation	中危	5.3	88.5%	PoCEXP	2021/02/25
CVE-2021-21972RCE VMware vSphere Client (HTML5) - Remote Code Execution cloud_foundation	严重	9.8	93.7%	PoCEXP	2021/02/25