Every CVE Search/ Get API key

CVE-2022-22954

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability...

9.8 CriticalIn KEVPublic exploit

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

100.0%Up 93.3 points since Apr 12, 2022
90%50%10%1%

What each source reports

NVD Score used 9.8

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.

Record
CVE-2022-22954
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-94
Updated
2026-11-02
CVE List 9.8

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.

Record
CVE-2022-22954
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
EUVDEUVD-2022-28077 9.8

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.

Record
EUVD-2022-28077
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-q7xc-35g4-g566 9.8

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability...

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.

Record
GHSA-q7xc-35g4-g566
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
CISA KEV No score

VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability

VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection.

Record
CVE-2022-22954
Weakness
CWE-94
Updated
2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubaxingde/CVE-2022-22954-POC2020-10-09
MetasploitVMware Workspace ONE Access CVE-2022-229542022-04-06
PoC in GitHubVulnmachines/VMWare_CVE-2022-229542022-04-11
PoC in GitHubaniqfakhrul/CVE-2022-229542022-04-11
PoC in GitHubsherlocksecurity/VMware-CVE-2022-229542022-04-11
PoC in GitHubDrorDvash/CVE-2022-22954_VMware_PoC2022-04-12
PoC in GitHubMSeymenD/CVE-2022-22954-Testi2022-04-12
PoC in GitHubcorelight/cve-2022-229542022-04-12
PoC in GitHubjax7sec/CVE-2022-229542022-04-12
PoC in GitHublucksec/VMware-CVE-2022-229542022-04-12
Show 17 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubmumu2020629/-CVE-2022-22954-scanner2022-04-12
PoC in GitHubJun-5heng/CVE-2022-229542022-04-13
PoC in GitHubbewhale/CVE-2022-229542022-04-13
PoC in GitHubtunelko/CVE-2022-22954-PoC2022-04-13
PoC in GitHubemilyastranova/VMware-CVE-2022-22954-Command-Injector2022-04-14
PoC in GitHubMLX15/CVE-2022-229542022-04-15
PoC in GitHubmhurts/CVE-2022-22954-POC2022-04-16
PoC in GitHubnguyenv1nK/CVE-2022-229542022-05-05
PoC in GitHubChocapikk/CVE-2022-229542022-06-01
PoC in GitHubsecfb/CVE-2022-229542022-06-01
PoC in GitHubb4dboy17/CVE-2022-229542022-06-03
PoC in GitHuborwagodfather/CVE-2022-229542022-06-03
PoC in GitHubarzuozkan/CVE-2022-229542022-06-11
PoC in GitHubamit-pathak009/CVE-2022-229542022-08-13
PoC in GitHubamit-pathak009/CVE-2022-22954-PoC2022-08-13
PoC in GitHubSchira4396/VcenterKiller2022-10-04
NucleiVMware Workspace ONE Access - Server-Side Template Injection

Plus 1 more. The full list has every link.

History

History
RecordedChangedSources
exploitation
exploits, exploits_more
exploits
first indexedCVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-22954 is a critical vulnerability (CVSS 9.8) in Vmware Identity Manager, published April 11, 2022. CISA lists it as known to be exploited, since April 14, 2022. EUVD reports exploitation since April 14, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 99th percentile. No source names a fixed version.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open