Description
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | VMware Workspace ONE Access, Identity Manager and vRealize Automation | Access 21.08.0.1, 21.08.0.0, 20.10.0.1, 20.10.0.0. Identity Manager 3.3.6, 3.3.5, 3.3.4, 3.3.3. vRealize Automation 7.6. | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 3 repositories
-
horizon3ai/CVE-2022-22972 ★ 148 · May 24, 2022
-
xk4ng/CVE-2022-22972 ★ 1 · May 28, 2022
vmware authentication bypass
-
bengisugun/CVE-2022-22972- ★ 0 · Jun 15, 2022
IOC List
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- VMware Workspace ONE Access/Identity Manager/vRealize Automation - Authentication Bypass http/cves/2022/CVE-2022-22972.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.