CVE-2022-22954
CVE-2022-22954
In short
VMware Workspace ONE Access and Identity Manager have a flaw that allows remote code execution through template injection. An attacker on the network can exploit this to run malicious code on the server.
Technical detail
Server-side template injection vulnerability in VMware Workspace ONE Access and Identity Manager allows unauthenticated remote code execution (CVSS 9.8). The vulnerability stems from improper input validation in template processing, enabling attackers with network access to inject malicious template directives that execute arbitrary code with server privileges.
Summary generated and translated by AI from the official description.
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · VMware Workspace ONE Access and Identity Managerpublic PoCs found — 26
githubgithub.com/Schira4396/VcenterKiller★ 1475githubgithub.com/sherlocksecurity/VMware-CVE-2022-22954★ 279githubgithub.com/bewhale/CVE-2022-22954★ 68githubgithub.com/tunelko/CVE-2022-22954-PoC★ 16githubgithub.com/jax7sec/CVE-2022-22954★ 12githubgithub.com/Vulnmachines/VMWare_CVE-2022-22954★ 11githubgithub.com/DrorDvash/CVE-2022-22954_VMware_PoC★ 10githubgithub.com/orwagodfather/CVE-2022-22954★ 8githubgithub.com/b4dboy17/CVE-2022-22954★ 5githubgithub.com/aniqfakhrul/CVE-2022-22954★ 4githubgithub.com/MLX15/CVE-2022-22954★ 4githubgithub.com/Chocapikk/CVE-2022-22954★ 4githubgithub.com/axingde/CVE-2022-22954-POC★ 2githubgithub.com/emilyastranova/VMware-CVE-2022-22954-Command-Injector★ 1githubgithub.com/mumu2020629/-CVE-2022-22954-scanner★ 1githubgithub.com/MSeymenD/CVE-2022-22954-Testi★ 1githubgithub.com/corelight/cve-2022-22954★ 1githubgithub.com/nguyenv1nK/CVE-2022-22954★ 0githubgithub.com/mhurts/CVE-2022-22954-POC★ 0githubgithub.com/secfb/CVE-2022-22954★ 0githubgithub.com/Jun-5heng/CVE-2022-22954★ 0githubgithub.com/lucksec/VMware-CVE-2022-22954★ 0githubgithub.com/arzuozkan/CVE-2022-22954★ 0githubgithub.com/amit-pathak009/CVE-2022-22954★ 0githubgithub.com/amit-pathak009/CVE-2022-22954-PoC★ 0cve_referencepacketstormsecurity.com/files/166935/VMware-Workspace-ONE-Access-Template-Injection-Command-Execution.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →