https://www.vmware.com/security/advisories/VMSA-2022-0028.html

The VMware Workspace One Assist server running on the remote host is affected multiple vulnerabilities, including the following:

  - VMware Workspace ONE Assist prior to 22.10 contains an Authentication Bypass vulnerability. A malicious     actor with network access to Workspace ONE Assist may be able to obtain administrative access without the     need to authenticate to the application. (CVE-2022-31685)

  - VMware Workspace ONE Assist prior to 22.10 contains a Broken Authentication Method vulnerability. A     malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access     without the need to authenticate to the application. (CVE-2022-31686)

  - VMware Workspace ONE Assist prior to 22.10 contains a Broken Access Control vulnerability. A malicious     actor with network access to Workspace ONE Assist may be able to obtain administrative access without the     need to authenticate to the application. (CVE-2022-31687)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version.

CVE-2022-31687

critical

Tenable Plugins

critical