Vrealize Automation

VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. A malicious actor, with non-administrative access to vRealize Orchestrator, may be able to use specially crafted input to bypass XML parsing restrictions leading to access to sensitive information or possible escalation of privileges.

Published: 2023-02-21T00:00:00.000Z
Updated: 2025-03-17T18:25:24.743Z

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an information disclosure vulnerability due to returning excess information. A malicious actor with remote access may leak the hostname of the target system. Successful exploitation of this issue can lead to targeting victims.

Published: 2022-04-13T17:05:56.000Z
Updated: 2024-08-03T03:28:42.477Z

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor with local access can escalate privileges to 'root'.

Published: 2022-04-13T00:00:00.000Z
Updated: 2025-10-21T23:15:42.338Z

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a cross site request forgery vulnerability. A malicious actor can trick a user through a cross site request forgery to unintentionally validate a malicious JDBC URI.

Published: 2022-04-13T17:05:54.000Z
Updated: 2024-08-03T03:28:42.618Z

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A malicious actor with administrative access can trigger deserialization of untrusted data through malicious JDBC URI which may result in remote code execution.

Published: 2022-04-13T17:05:58.000Z
Updated: 2024-08-03T03:28:42.552Z