Security News > 2022 > November > VMware fixes three critical auth bypass bugs in remote access tool
VMware has released security updates to address three critical severity vulnerabilities in the Workspace ONE Assist solution that enable remote attackers to bypass authentication and elevate privileges to admin.
Workspace ONE Assist provides remote control, screen sharing, file system management, and remote command execution to help desk and IT staff remotely access and troubleshoot devices in real time from the Workspace ONE console.
"A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application," VMware describes the three security bugs.
All vulnerabilities patched today have been found and reported to VMware by Jasper Westerman, Jan van der Put, Yanick de Pater, and Harm Blankers of REQON IT-Security.
In August, VMware warned admins to patch another critical authentication bypass security flaw in VMware Workspace ONE Access, Identity Manager, and vRealize Automation, enabling unauthenticated attackers to gain admin privileges.
In May, VMware patched an almost identical critical vulnerability, another authentication bypass found by Bruno López of Innotec Security in Workspace ONE Access, VMware Identity Manager, and vRealize Automation.
News URL
Related news
- ASUS warns of critical remote authentication bypass on 7 routers (source)
- Patch up – 4 critical bugs in ArubaOS lead to remote code execution (source)
- Critical Tinyproxy Flaw Opens Over 50,000 Hosts to Remote Code Execution (source)
- Critical GitHub Enterprise Server Flaw Allows Authentication Bypass (source)
- Veeam warns of critical Backup Enterprise Manager auth bypass bug (source)
- Critical Veeam Backup Enterprise Manager Flaw Allows Authentication Bypass (source)
- Ivanti Patches Critical Remote Code Execution Flaws in Endpoint Manager (source)
- Attackers are probing Check Point Remote Access VPN devices (source)
- Exploit for critical Progress Telerik auth bypass released, patch now (source)
- Exploit for critical Veeam auth bypass available, patch now (source)