VMware Releases Critical Security Updates for Multiple Products

Critical advisory addresses vulnerabilities affecting vRealize Network Insight (vRNI)

VMware has released a security update to address two security vulnerabilities in vRealize Network Insight (vRNI). The first vulnerability CVE-2022-31702 has a CVSSv3 score of 9.8 and concerns command injection, potentially allowing an attacker with network access to the vRNI REST API to execute commands without authentication. 

The second vulnerability CVE-2022-31703 has a CVSSv3 score of 7.5 and involves directory traversal, potentially allowing an attacker with network access to the vRNI REST API to read arbitrary files from the server.

Important advisory for vulnerability affecting Workspace ONE Access, Identity Manager, and Cloud Foundation

VMware has released a security update to address two security vulnerabilities within VMware Workspace ONE Access (Access), VMware Identity Manager (vIDM), and VMware Cloud Foundation (Cloud Foundation). The first vulnerability CVE-2022-31700 has a CVSSv3 score of 7.2 concerns authenticated remote code execution (RCE), potentially allowing an attacker with administrator and network access to remotely execute code on the underlying operating system. 

The second vulnerability CVE-2022-31701 has a CVSSv3 score of 5.3 and is a broken authentication vulnerability, potentially allowing an attacker with network access to obtain system information and can lead to targeting victims.

Note: Access Connector and vIDM Connector are unaffected.

Critical advisory for vulnerability affecting ESXi, Workstation Pro / Player, and Fusion Pro / Fusion

VMware has released a security update to address a security vulnerability within VMware ESXi, VMware Workstation Pro / Player (Workstation), and VMware Fusion Pro / Fusion (Fusion). The vulnerability CVE-2022-31705 has a CVSSv3 score of 9.3 and concerns heap out-of-bounds write in the USB 2.0 controller (EHCI), potentially allowing an attacker with local adminstrative privileges to execute code as the virtual machine's VMX process running on the host. 

On ESXi the exploitation is contained within the VMX sandbox, while on Workstation and Fusion the exploitation may lead to code execution on the machine where Workstation or Fusion is installed.