{"id":3110,"date":"2022-08-04T16:05:23","date_gmt":"2022-08-04T21:05:23","guid":{"rendered":"https:\/\/cert.pa\/?p=3110"},"modified":"2022-08-04T16:05:23","modified_gmt":"2022-08-04T21:05:23","slug":"csirt-panama-aviso-2022-08-04-vmware-multiples-vulnerabilidades-en-productos-vmware","status":"publish","type":"post","link":"https:\/\/cert.pa\/?p=3110","title":{"rendered":"CSIRT Panam\u00e1 Aviso 2022-08-04 VMware: M\u00faltiples vulnerabilidades en productos VMware"},"content":{"rendered":"\n

Gravedad: Alta
Fecha de publicaci\u00f3n: Agosto 4, 2022
\u00daltima revisi\u00f3n: Agosto 4, 2022
Sitio web: https:\/\/www.vmware.com\/
Sistemas Afectados:<\/p>\n\n\n\n

\u2022 VMware Workspace ONE Access (Access),
\u2022 VMware Workspace ONE Access Connector (Access Connector),
\u2022 VMware Identity Manager (vIDM),
\u2022 VMware Identity Manager Connector (vIDM Connector),
\u2022 VMware vRealize Automation (vRA),
\u2022 VMware Cloud Foundation,
\u2022 vRealize Suite Lifecycle Manager.<\/p>\n\n\n\n

I. Descripci\u00f3n<\/p>\n\n\n\n

Se han publicado m\u00faltiples vulnerabilidades en productos VMware que podr\u00edan permitir a un atacante obtener acceso de administrador, ejecutar c\u00f3digo de forma remota, escalar privilegios, obtener acceso a archivos arbitrarios o inyectar c\u00f3digo javascript.<\/p>\n\n\n\n

II. Impacto<\/p>\n\n\n\n

Vulnerabilidad CVE-2022-31656:<\/p>\n\n\n\n

Una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n podr\u00eda permitir a un atacante con acceso a la interfaz de usuario por red, obtener acceso de administrador sin necesidad de autenticarse.<\/p>\n\n\n\n

Vulnerabilidad 2022-31658 y CVE-2022-31665: Ejecuci\u00f3n remota de c\u00f3digo por inyecci\u00f3n de JDBC.<\/p>\n\n\n\n

Vulnerabilidad CVE-2022-31659: Ejecuci\u00f3n remota de c\u00f3digo por inyecci\u00f3n SQL.<\/p>\n\n\n\n

Vulnerabilidad CVE-2022-31660, CVE-2022-31661 y CVE-2022-31664:
Escalada de privilegios local.<\/p>\n\n\n\n

Vulnerabilidad CVE-2022-31657: Inyecci\u00f3n de URLs.<\/p>\n\n\n\n

Vulnerabilidad CVE-2022-31662: Limitaci\u00f3n incorrecta de la ruta a un directorio restringido.<\/p>\n\n\n\n

Vulnerabilidad CVE-2022-31663: Cross-site scripting (XSS).<\/p>\n\n\n\n

III. Referencia a soluciones, herramientas e informaci\u00f3n<\/p>\n\n\n\n

Actualizar a las versiones correspondientes, enlace: https:\/\/kb.vmware.com\/s\/article\/89096<\/p>\n\n\n\n

Fuentes:<\/p>\n\n\n\n

  1. CSIRT Nacional de Chile. 9VSA22-00684-01 CSIRT alerta de vulnerabilidades en productos VMware. 3 de agosto del 2022. Recopilado en: https:\/\/www.csirt.gob.cl\/vulnerabilidades\/9vsa22-00684-01\/<\/li>
  2. Instituto Nacional de Ciberseguridad, INCIBE. Avisos Seguridad, M\u00faltiples vulnerabilidades en productos VMware. 3 de agosto del 2022. Recopilado en: https:\/\/www.incibe-cert.es\/alerta-temprana\/avisos-seguridad\/multiples-vulnerabilidades-productos-vmware-27<\/li><\/ol>\n\n\n\n

    Informaci\u00f3n de contacto<\/p>\n\n\n\n

    CSIRT PANAMA
    Computer Security Incident Response Team Autoridad Nacional para la Innovacion Gubernamental
    E-Mail: info@cert.pa
    Phone: +507 520-CERT (2378)
    Web: https:\/\/cert.pa
    Twitter: @CSIRTPanama
    Key ID: 16F2B124<\/p>\n","protected":false},"excerpt":{"rendered":"

    Gravedad: AltaFecha de publicaci\u00f3n: Agosto 4, 2022\u00daltima revisi\u00f3n: Agosto 4, 2022Sitio web: https:\/\/www.vmware.com\/Sistemas Afectados: \u2022 VMware Workspace ONE Access (Access),\u2022 VMware Workspace ONE Access Connector (Access Connector),\u2022 VMware Identity Manager (vIDM),\u2022 VMware Identity Manager Connector…<\/p>\n","protected":false},"author":4,"featured_media":2747,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[4],"tags":[],"class_list":["post-3110","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-avisos-de-seguridad"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/3110","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3110"}],"version-history":[{"count":1,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/3110\/revisions"}],"predecessor-version":[{"id":3111,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/3110\/revisions\/3111"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/media\/2747"}],"wp:attachment":[{"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3110"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3110"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3110"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}