CVE-2022-31656: 
Workspace ONE Access Connector vulnerability analysis and mitigation

CVE-2022-31656 is a critical authentication bypass vulnerability affecting VMware Workspace ONE Access, Identity Manager and vRealize Automation, discovered and reported by PetrusViet of VNG Security. The vulnerability was disclosed on August 2, 2022, with a critical CVSSv3 base score of 9.8. The affected products include VMware Workspace ONE Access, Identity Manager, and vRealize Automation running on Linux systems (VMware Advisory).

The vulnerability allows an attacker with network access to the user interface to bypass authentication mechanisms affecting local domain users. The severity is rated as Critical with a CVSSv3 score of 9.8, indicating the highest level of risk. The vulnerability appears to be a variant or patch bypass of a previous vulnerability (CVE-2022-22972) that was patched in an earlier advisory (Tenable Blog).

A successful exploitation of this vulnerability allows a malicious actor with network access to the UI to obtain administrative access without authentication. This level of access could potentially lead to complete system compromise. VMware confirmed that malicious code capable of exploiting this vulnerability in impacted products became publicly available (VMware Advisory).

VMware released patches to address this vulnerability and strongly recommended immediate application of these updates. The fixes are available through VMware's Knowledge Base article KB89096. For organizations unable to immediately apply patches, temporary workarounds are documented in KB89084. VMware emphasized that this should be treated as an emergency change in organizations using ITIL methodologies (VMware Advisory).

Security analysts and researchers emphasized the critical nature of this vulnerability, particularly given the history of attacks targeting VMware Workspace ONE instances. The security community urged organizations to apply patches immediately, especially considering the public availability of exploit code (Tenable Blog).