CVE-2022-22954
Quick assessment
Affected
n/a VMware Workspace ONE Access and Identity Manager
Exploitation
Confirmed exploitation in the wild; remediate immediately
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Vmware Workspace One Access是美国Vmware公司的将用户身份与设备和网络信息等因素结合起来，为 Workspace One 交付的应用程序制定智能驱动的条件访问决策。 VMware 多款产品存在代码注入漏洞，该漏洞源于不正确的输入验证。远程攻击者利用该漏洞发送特制的HTTP请求并执行服务器端模板注入。
Public Exploits 2
Metasploit · 1
vmware_workspace_one_access_cve_2022_22954.rb [exploit]
Nuclei · 1
CVE-2022-22954.yaml [template]
In-the-Wild Activity Observed
cisa_kev · confirmed
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-22954
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
VMware 多款产品代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Vmware Workspace One Access是美国Vmware公司的将用户身份与设备和网络信息等因素结合起来，为 Workspace One 交付的应用程序制定智能驱动的条件访问决策。 VMware 多款产品存在代码注入漏洞，该漏洞源于不正确的输入验证。远程攻击者利用该漏洞发送特制的HTTP请求并执行服务器端模板注入。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | VMware Workspace ONE Access and Identity Manager | Access 21.08.0.1, 21.08.0.0, 20.10.0.1, 20.10.0.0. Identity Manager 3.3.6, 3.3.5, 3.3.4, 3.3.3. | - |
|
II. Public POCs for CVE-2022-22954
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | 提供单个或批量URL扫描是否存在CVE-2022-22954功能 | https://github.com/axingde/CVE-2022-22954-POC | POC Details |
| 2 | POC for VMWARE CVE-2022-22954 | https://github.com/sherlocksecurity/VMware-CVE-2022-22954 | POC Details |
| 3 | CVE-2022-22954 is a server-side template injection vulnerability in the VMware Workspace ONE Access and Identity Manager | https://github.com/Vulnmachines/VMWare_CVE-2022-22954 | POC Details |
| 4 | None | https://github.com/aniqfakhrul/CVE-2022-22954 | POC Details |
| 5 | 提供批量扫描URL以及执行命令功能。Workspace ONE Access 模板注入漏洞，可执行任意代码 | https://github.com/jax7sec/CVE-2022-22954 | POC Details |
| 6 | CVE-2022-22954-VMware-RCE批量检测POC | https://github.com/bb33bb/CVE-2022-22954-VMware-RCE | POC Details |
| 7 | None | https://github.com/lucksec/VMware-CVE-2022-22954 | POC Details |
| 8 | None | https://github.com/mumu2020629/-CVE-2022-22954-scanner | POC Details |
| 9 | CVE-2022-22954 Açığı test etme | https://github.com/MSeymenD/CVE-2022-22954-Testi | POC Details |
| 10 | None | https://github.com/corelight/cve-2022-22954 | POC Details |
| 11 | PoC for CVE-2022-22954 - VMware Workspace ONE Access Freemarker Server-Side Template Injection | https://github.com/DrorDvash/CVE-2022-22954_VMware_PoC | POC Details |
| 12 | VMware Workspace ONE Access远程代码执行漏洞 / Code By:Jun_sheng | https://github.com/Jun-5heng/CVE-2022-22954 | POC Details |
| 13 | VMware Workspace ONE Access and Identity Manager RCE via SSTI - Test script for shodan, file or manual. | https://github.com/tunelko/CVE-2022-22954-PoC | POC Details |
| 14 | CVE-2022-22954 VMware Workspace ONE Access freemarker SSTI 漏洞 命令执行、批量检测脚本、文件写入 | https://github.com/bewhale/CVE-2022-22954 | POC Details |
| 15 | Proof of Concept for exploiting VMware CVE-2022-22954 | https://github.com/tyleraharrison/VMware-CVE-2022-22954-Command-Injector | POC Details |
| 16 | CVE-2022-22954 VMware Workspace ONE Access free marker SSTI | https://github.com/MLX15/CVE-2022-22954 | POC Details |
| 17 | None | https://github.com/mhurts/CVE-2022-22954-POC | POC Details |
| 18 | CVE-2022-22954 analyst | https://github.com/nguyenv1nK/CVE-2022-22954 | POC Details |
| 19 | Python script to exploit CVE-2022-22954 and then exploit CVE-2022-22960 | https://github.com/Chocapikk/CVE-2022-22954 | POC Details |
| 20 | Python script to exploit CVE-2022-22954 and then exploit CVE-2022-22960 | https://github.com/secfb/CVE-2022-22954 | POC Details |
| 21 | None | https://github.com/orwagodfather/CVE-2022-22954 | POC Details |
| 22 | VMware Workspace ONE Access and Identity Manager RCE via SSTI. CVE-2022-22954 - PoC SSTI * exploit+payload+shodan (ну набором) | https://github.com/b4dboy17/CVE-2022-22954 | POC Details |
| 23 | Practising technical writing with researching CVE-2022-22954 VMware Workspace ONE Access RCE vulnerability. | https://github.com/arzuozkan/CVE-2022-22954 | POC Details |
| 24 | I'm trying | https://github.com/1SeaMy/CVE-2022-22954 | POC Details |
| 25 | None | https://github.com/amit-pathak009/CVE-2022-22954 | POC Details |
| 26 | None | https://github.com/amit-pathak009/CVE-2022-22954-PoC | POC Details |
| 27 | 一款针对Vcenter的综合利用工具，包含目前最主流的CVE-2021-21972、CVE-2021-21985以及CVE-2021-22005、One Access的CVE-2022-22954、CVE-2022-22972/31656以及log4j，提供一键上传webshell，命令执行或者上传公钥使用SSH免密连接 | https://github.com/Schira4396/VcenterKiller | POC Details |
| 28 | None | https://github.com/lolminerxmrig/CVE-2022-22954_ | POC Details |
| 29 | None | https://github.com/Jhonsonwannaa/CVE-2022-22954 | POC Details |
| 30 | Proof of Concept for exploiting VMware CVE-2022-22954 | https://github.com/emilyastranova/VMware-CVE-2022-22954-Command-Injector | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-22954
请登录查看更多情报信息。
Vendor Advisories for CVE-2022-22954 (1)
-
https://www.vmware.com/security/advisories/VMSA-2022-0011.html x_refsource_MISC
Same Patch Batch · n/a · 2022-04-11 · 37 CVEs total
| CVE-2021-32162 | Webmin 跨站请求伪造漏洞 | |
| CVE-2021-37291 | KevinLAB Building Energy Management System SQL注入漏洞 | |
| CVE-2021-40219 | Bolt CMS 代码注入漏洞 | |
| CVE-2022-27111 | Jfinal CMS跨站脚本漏洞 | |
| CVE-2022-27156 | Daylight Studio Fuel CMS跨站脚本漏洞 | |
| CVE-2022-27115 | elFinder 代码问题漏洞 | |
| CVE-2022-27088 | Ivanti DSM Remote 及 代码问题漏洞 | |
| CVE-2022-27089 | Fujitsu PlugFree Network 代码问题漏洞 | |
| CVE-2022-27041 | openSIS SQL注入漏洞 | |
| CVE-2021-37293 | KevinLAB Building Energy Management System 路径遍历漏洞 | |
| CVE-2021-32161 | Webmin 跨站脚本漏洞 | |
| CVE-2021-32160 | Webmin 跨站脚本漏洞 | |
| CVE-2021-32159 | Webmin 跨站请求伪造漏洞 | |
| CVE-2021-32158 | Webmin 跨站脚本漏洞 | |
| CVE-2021-32157 | Webmin 跨站脚本漏洞 | |
| CVE-2021-32156 | Webmin 跨站请求伪造漏洞 | |
| CVE-2022-28893 | Linux kernel 资源管理错误漏洞 | |
| CVE-2022-25794 | Autodesk FBX Review 缓冲区错误漏洞 | |
| CVE-2022-25790 | Autodesk AutoCAD 缓冲区错误漏洞 | |
| CVE-2021-4047 | Red Hat OpenShift 输入验证错误漏洞 |
Showing top 20 of 37 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2022-22954
No comments yet