Actively exploited · Published Mar 29, 2022 · Assigned by vmware
CVE-2022-22948
Medium 6.5 Exploited
In plain English
A medium-severity incorrect default permissions in VMware vCenter Server and VMware Cloud Foundation. Attackers are actively exploiting it in the wild (listed by CISA on July 17, 2024). The chance it is exploited in the next 30 days is estimated at 13.3% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Aug 7, 2024.
Official description
The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | VMware vCenter Server and VMware Cloud Foundation | VMware vCenter Server (7.0 prior to 7.0 U3d, 6.7 prior to 6.7 U3p and 6.5 prior to 6.5 U3r) and VMware Cloud Foundation (4.x and 3.x prior to 3.11) |
Weakness: CWE-276 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://www.vmware.com/security/advisories/VMSA-2022-0009.html x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22948 government-resource