VMware Workspace ONE Assist prior to 22.10 contains a Broken Access Control vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application.

The VMware Workspace One Assist server running on the remote host is affected multiple vulnerabilities, including the following:

  - VMware Workspace ONE Assist prior to 22.10 contains an Authentication Bypass vulnerability. A malicious     actor with network access to Workspace ONE Assist may be able to obtain administrative access without the     need to authenticate to the application. (CVE-2022-31685)

  - VMware Workspace ONE Assist prior to 22.10 contains a Broken Authentication Method vulnerability. A     malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access     without the need to authenticate to the application. (CVE-2022-31686)

  - VMware Workspace ONE Assist prior to 22.10 contains a Broken Access Control vulnerability. A malicious     actor with network access to Workspace ONE Assist may be able to obtain administrative access without the     need to authenticate to the application. (CVE-2022-31687)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version.

Detections

Analytics

CVE-2022-31687

critical

Tenable Plugins

critical