Critical vulnerabilities affecting VMware products have been fixed

VMware has fixed another batch of vulnerabilities, approximately one month after the ones which were found in the VMware Workspace ONE Access. The new vulnerabilities, which can be tracked as CVE-2022-22972 and CVE-2022-22973 are also affecting Access and some other products and they have CVSS scores of 9.8 and 7.8, respectively.

Administrative access without authentication

CVE-2022-22972 is an authentication bypass vulnerability that affects VMware Workspace ONE Access, Identity Manager, and vRealize Automation. This vulnerability allows obtaining administrative access without authentication for the malicious actors with network access to network UI. 

CVE-2022-22973 is a local privilege escalation vulnerability that affects VMware Workspace ONE Access and Identity Manager. It requires the threat actor to be able to access the system locally; then he can escalate the privileges to the “root” level. 

You can see all of the affected versions of the VMware products below:

• Access: 21.08.0.1, 21.08.0.0, 20.10.0.1, 20.10.0.0
• vIDM: 3.3.6, 3.3.5, 3.3.4, 3.3.3
• vRealize Automation: 7.6

Download the patch files

You can use the link below to download the required patch files:

You can follow the steps below to apply the patches for the vulnerable products:

• Login as sshuser, sudo to root-level access.
• Download and transfer HW-156875-Appliance-<Version>.zip to the virtual appliance. This .zip file can be saved anywhere on the file system. VMware recommends SCP protocol to transfer the file to the appliance. Tools such as WinSCP can also be used to transfer the file to the appliance.
• Unzip the file using the command: unzip HW-156875-Appliance-<Version>.zip 
• Navigate to the files within the unzipped folder using the command: cd HW-156875-Appliance-<Version>
• Run the patch script using the command: ./HW-156875-applyPatch.sh

VMware has also published the workaround for those who do not want to change the versions of VMware products:

• Run View-Active-Admin-users.sql to see all administrators (read-only administrators also included) and run View-Active-Local-users.sql to see all local users who will be disabled. Make sure that View-Active-Admin-users.sql shows at least 1 provisioned (usually from a Directory) administrator  
• Run Disable_All_Local_users.sql to disable all local users and administrators 
• Run View-Active-Admin-users.sql to see which administrators now remain active. Only provisioned (usually Directory users) userType administrators should show here. 
• Log in to Workspace ONE Access/VMware Identity Manager appliance using a sshclient as a root user. Restart the service using the command “service horizon-workspace restart”. Repeat this process for all appliances in your environment. 
• Until the hotfixes are applied, do not create any new local users.

Click here to show all instructions about the patch