FortiGuard Labs is aware that VMware has confirmed a recently patched critical vulnerability in VMware Workspace ONE Access and Identity Manager (CVE-2022-22954) has been exploited in the wild. Also, a Proof-of-Concept (PoC) code has already been made available to the public. An attacker with network access can trigger a server-side template injection that may result in remote code execution.Why is this Significant?This is significant because of the critical remote code execution vulnerability affecting Workspace ONE Access and VMware Identity Manager (vIDM) that are widely used. Since VMware has acknowledged in-the-wild exploitation of CVE-2022-22954 and a POC is available to the public, attacks that leverage the vulnerability will likely increase.What is CVE-2022-22954?CVE-2022-22954 is a vulnerability in Workspace ONE Access and VMware Identity Manager (vIDM), which an attacker with network access can trigger a server-side template injection that may result in remote code execution. The vulnerability has the CVSSv3 base score of 9.8 and is rated critical.Is the Vulnerability Exploited in the Wild?VMware has confirmed that exploitation of CVE-2022-22954 has occurred in the wild.Has the Vendor Released Security Advisories for CVE-2022-22954?Yes, VMware released a security advisory for the vulnerability on April 6th, 2022. See the Appendix for a link to “VMSA-2022-0011”.The advisory was updated further on April 13th, 2022 for the confirmation of the in-the-wild exploitation. Has the Vendor Released a Patch for CVE-2022-22954?Yes, VMware released a patch on April 6th, 2022 as part of its security advisory. See the Appendix for a link to “VMSA-2022-0011”. What is the Status of Coverage?FortiGuard Labs has released the following IPS signature for CVE-2022-22954 in version 20.297:VMware.Workspace.ONE.Access.Catalog.Remote.Code.Execution (default action is set to pass)What Mitigation Steps are Available?VMware has released a KB article that includes the workaround. See the Appendix for a link to “HW-154129 – Workaround instructions to address CVE-2022-22954, CVE-2022-22955, CVE-2022-22956, CVE-2022-22957, CVE-2022-22958, CVE-2022-22959, CVE-2022-22960 in Workspace ONE Access Appliance (VMware Identity Manager) (88098)”.

Read More

Posted by Asterisk Security Team on Apr 14

Asterisk Project Security Advisory – AST-2022-003

Product Asterisk
Summary func_odbc: Possible SQL Injection
Nature of Advisory SQL injection
Susceptibility Remote unauthenticated sessions
Severity Low…

Read More

Posted by Asterisk Security Team on Apr 14

Asterisk Project Security Advisory – AST-2022-002

Product Asterisk
Summary res_stir_shaken: SSRF vulnerability with Identity
header
Nature of Advisory Server-side request forgery
Susceptibility Remote unauthenticated access…

Read More

Posted by Asterisk Security Team on Apr 14

Asterisk Project Security Advisory – AST-2022-001

Product Asterisk
Summary res_stir_shaken: resource exhaustion with large
files
Nature of Advisory Resource exhaustion
Susceptibility Remote unauthenticated access…

Read More

Active debug code in the B. Braun Melsungen AG SpaceCom Version L8/U61, and the Data module compactplus Versions A10 and A11 and earlier enables attackers in possession of cryptographic material to access the device as root.

Read More

A reflected cross-site scripting (XSS) vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows remote attackers to inject arbitrary web script or HTML into various locations.

Read More

Improper access controls in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 enables attackers to extract and tamper with the devices network configuration.

Read More

A XPath injection vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows unauthenticated remote attackers to access sensitive information and escalate privileges.

Read More

A vulnerability in the configuration import mechanism of the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers with command line access to the underlying Linux system to escalate privileges to the root user.

Read More

A relative path traversal attack in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers with service user privileges to upload arbitrary files. By uploading a specially crafted tar file an attacker can execute arbitrary commands.

Read More