Privilege escalation in Micro Focus Zenworks Asset Management
CVE-2022-38757
A vulnerability has been identified in Micro Focus ZENworks 2020 Update 3a and prior versions. This vulnerability allows administrators with rights to perform actions (e.g., install a bundle) on a set of managed devices, to be able to exercise these rights on managed devices in the ZENworks zone but which are outside the scope of the administrator. This vulnerability does not result in the administrators gaining additional rights on the managed devices, either in the scope or outside the scope of the administrator.
Vulnerability class: Privilege Escalation
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.008 (56.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 56th percentile — 56.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- Micro Focus Zenworks Asset Management — versions ZENworks 2020
- Micro Focus Zenworks Configuration Management (Zcm) — versions ZENworks 2020
- Micro Focus Zenworks Endpoint Security Management (Zesm) — versions ZENworks 2020
- Micro Focus Zenworks Patch Management (Zpm) — versions ZENworks 2020
- Microfocus Zenworks — versions 2020
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2022-38757?
- CVE-2022-38757 is a high-severity vulnerability in Micro Focus Zenworks Asset Management, classified under Improper Privilege Management. CVSS score: 7.2/10. Published 2022-12-23.
- How severe is CVE-2022-38757?
- High severity. CVSS v3 base score is 7.2 out of 10.
- Is CVE-2022-38757 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.