Vulnerability · Published May 24, 2022 · Assigned by vmware
CVE-2022-22977
High 7.1
In plain English
A high-severity XML external entity in VMware Tools for Windows. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.8%top 43.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
VMware Tools for Windows(12.0.0, 11.x.y and 10.x.y) contains an XML External Entity (XXE) vulnerability. A malicious actor with non-administrative local user privileges in the Windows guest OS, where VMware Tools is installed, may exploit this issue leading to a denial-of-service condition or unintended information disclosure.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | VMware Tools for Windows | VMware Tools for Windows (12.0.0, 11.x.y and 10.x.y) |
Weakness: CWE-611 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
References
- https://www.vmware.com/security/advisories/VMSA-2022-0015.html x_refsource_MISC