A vulnerability has been discovered in Apache Struts, which could allow for remote code execution. Apache Struts is an open source framework used for building Java web applications. Successful exploitation of this vulnerability could allow for remote code execution. Depending on the privileges associated with the user, an attacker could then install programs; view; change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
A vulnerability has been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Google Chrome is a web browser used to access the Internet. Successful exploitation of the most severe could allow an attacker to execute arbitrary code in the context of the browser. Depending on the privileges associated with the application, an attacker could view, change, or delete data. If this application has been configured to have fewer user rights on the system, exploitation of the most severe of this vulnerability could have less impact than if it was configured with administrative rights.
FortiGuard Labs is aware that VMware has confirmed a recently patched critical vulnerability in VMware Workspace ONE Access and Identity Manager (CVE-2022-22954) has been exploited in the wild. Also, a Proof-of-Concept (PoC) code has already been made available to the public. An attacker with network access can trigger a server-side template injection that may result in remote code execution.Why is this Significant?This is significant because of the critical remote code execution vulnerability affecting Workspace ONE Access and VMware Identity Manager (vIDM) that are widely used. Since VMware has acknowledged in-the-wild exploitation of CVE-2022-22954 and a POC is available to the public, attacks that leverage the vulnerability will likely increase.What is CVE-2022-22954?CVE-2022-22954 is a vulnerability in Workspace ONE Access and VMware Identity Manager (vIDM), which an attacker with network access can trigger a server-side template injection that may result in remote code execution. The vulnerability has the CVSSv3 base score of 9.8 and is rated critical.Is the Vulnerability Exploited in the Wild?VMware has confirmed that exploitation of CVE-2022-22954 has occurred in the wild.Has the Vendor Released Security Advisories for CVE-2022-22954?Yes, VMware released a security advisory for the vulnerability on April 6th, 2022. See the Appendix for a link to “VMSA-2022-0011”.The advisory was updated further on April 13th, 2022 for the confirmation of the in-the-wild exploitation. Has the Vendor Released a Patch for CVE-2022-22954?Yes, VMware released a patch on April 6th, 2022 as part of its security advisory. See the Appendix for a link to “VMSA-2022-0011”. What is the Status of Coverage?FortiGuard Labs has released the following IPS signature for CVE-2022-22954 in version 20.297:VMware.Workspace.ONE.Access.Catalog.Remote.Code.Execution (default action is set to pass)What Mitigation Steps are Available?VMware has released a KB article that includes the workaround. See the Appendix for a link to “HW-154129 – Workaround instructions to address CVE-2022-22954, CVE-2022-22955, CVE-2022-22956, CVE-2022-22957, CVE-2022-22958, CVE-2022-22959, CVE-2022-22960 in Workspace ONE Access Appliance (VMware Identity Manager) (88098)”.
A XPath injection vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows unauthenticated remote attackers to access sensitive information and escalate privileges.
Improper access controls in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 enables attackers to extract and tamper with the devices network configuration.
A reflected cross-site scripting (XSS) vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows remote attackers to inject arbitrary web script or HTML into various locations.
Active debug code in the B. Braun Melsungen AG SpaceCom Version L8/U61, and the Data module compactplus Versions A10 and A11 and earlier enables attackers in possession of cryptographic material to access the device as root.
