FortiGuard Labs is aware that VMware has confirmed a recently patched critical vulnerability in VMware Workspace ONE Access and Identity Manager (CVE-2022-22954) has been exploited in the wild. Also, a Proof-of-Concept (PoC) code has already been made available to the public. An attacker with network access can trigger a server-side template injection that may result in remote code execution.Why is this Significant?This is significant because of the critical remote code execution vulnerability affecting Workspace ONE Access and VMware Identity Manager (vIDM) that are widely used. Since VMware has acknowledged in-the-wild exploitation of CVE-2022-22954 and a POC is available to the public, attacks that leverage the vulnerability will likely increase.What is CVE-2022-22954?CVE-2022-22954 is a vulnerability in Workspace ONE Access and VMware Identity Manager (vIDM), which an attacker with network access can trigger a server-side template injection that may result in remote code execution. The vulnerability has the CVSSv3 base score of 9.8 and is rated critical.Is the Vulnerability Exploited in the Wild?VMware has confirmed that exploitation of CVE-2022-22954 has occurred in the wild.Has the Vendor Released Security Advisories for CVE-2022-22954?Yes, VMware released a security advisory for the vulnerability on April 6th, 2022. See the Appendix for a link to “VMSA-2022-0011”.The advisory was updated further on April 13th, 2022 for the confirmation of the in-the-wild exploitation. Has the Vendor Released a Patch for CVE-2022-22954?Yes, VMware released a patch on April 6th, 2022 as part of its security advisory. See the Appendix for a link to “VMSA-2022-0011”. What is the Status of Coverage?FortiGuard Labs has released the following IPS signature for CVE-2022-22954 in version 20.297:VMware.Workspace.ONE.Access.Catalog.Remote.Code.Execution (default action is set to pass)What Mitigation Steps are Available?VMware has released a KB article that includes the workaround. See the Appendix for a link to “HW-154129 – Workaround instructions to address CVE-2022-22954, CVE-2022-22955, CVE-2022-22956, CVE-2022-22957, CVE-2022-22958, CVE-2022-22959, CVE-2022-22960 in Workspace ONE Access Appliance (VMware Identity Manager) (88098)”.
Daily Archives: April 14, 2022
AST-2022-003: func_odbc: Possible SQL Injection
Posted by Asterisk Security Team on Apr 14
Asterisk Project Security Advisory – AST-2022-003
Product Asterisk
Summary func_odbc: Possible SQL Injection
Nature of Advisory SQL injection
Susceptibility Remote unauthenticated sessions
Severity Low…
AST-2022-002: res_stir_shaken: SSRF vulnerability with Identity header
Posted by Asterisk Security Team on Apr 14
Asterisk Project Security Advisory – AST-2022-002
Product Asterisk
Summary res_stir_shaken: SSRF vulnerability with Identity
header
Nature of Advisory Server-side request forgery
Susceptibility Remote unauthenticated access…
AST-2022-001: res_stir_shaken: resource exhaustion with large files
Posted by Asterisk Security Team on Apr 14
Asterisk Project Security Advisory – AST-2022-001
Product Asterisk
Summary res_stir_shaken: resource exhaustion with large
files
Nature of Advisory Resource exhaustion
Susceptibility Remote unauthenticated access…
CVE-2020-25162
A XPath injection vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows unauthenticated remote attackers to access sensitive information and escalate privileges.
CVE-2020-25160
Improper access controls in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 enables attackers to extract and tamper with the devices network configuration.
CVE-2020-25158
A reflected cross-site scripting (XSS) vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows remote attackers to inject arbitrary web script or HTML into various locations.
CVE-2020-25156
Active debug code in the B. Braun Melsungen AG SpaceCom Version L8/U61, and the Data module compactplus Versions A10 and A11 and earlier enables attackers in possession of cryptographic material to access the device as root.
CVE-2020-25154
An open redirect vulnerability in the administrative interface of the B. Braun Melsungen AG SpaceCom device Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers to redirect users to malicious websites.
CVE-2020-25152
A session fixation vulnerability in the B. Braun Melsungen AG SpaceCom administrative interface Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows remote attackers to hijack web sessions and escalate privileges.