HomePentest-Tools.com Logo

VMware Workspace One - Arbitrary File Read (CVE-2022-31656)

Severity
CVSSv3 Score
9.8
Exploitable with Sniper
Yes
Vulnerability description

VMware Workspace One is affected by a Pre-Authorization Arbitrary File Read vulnerability in the /SAAS/ endpoint. This allows attackers to read sensitive information from the target system by sending a specially crafted HTTP GET request to the vulnerable endpoint. The affected endpoints are /WEB-INF/web.xml and styleboard.config.

Exploit capabilities

Sniper can read arbitrary files from the target system and extract them as evidence.

Risk description

The risk exists that a remote unauthenticated attacker could exploit this vulnerability to read sensitive information from arbitrary files located on the file system of the server.

Recommendation

Upgrade the VMware Workspace One to the latest version.

Detectable with
Network Scanner
Vuln date
May 2022
Published at
Updated at
Software Type
Virtualization
Vendor
VMware
Product
Workspace One
Codename
Not available