Vulnerability details
CVE-2022-22948
Actively exploited
VMware Cloud FoundationVMware vCenter ServerVMware vCenter Server and VMware Cloud Foundation
CVSS 3.1
6.5Medium
Official description
The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 6.5Medium | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| VMware | Cloud Foundation | 3.0 ≤ v < 3.11 | CISA ADP / Vulnrichment |
| VMware | Cloud Foundation | 4.0 ≤ v < 5.0 | CISA ADP / Vulnrichment |
| VMware | vCenter Server | 6.5 ≤ v < 6.5_u3r | CISA ADP / Vulnrichment |
| VMware | vCenter Server | 6.7 ≤ v < 6.7_u3p | CISA ADP / Vulnrichment |
| VMware | vCenter Server | 7.0 ≤ v < 7.0_u3d | CISA ADP / Vulnrichment |
| — | VMware vCenter Server and VMware Cloud Foundation | VMware vCenter Server (7.0 prior to 7.0 U3d, 6.7 prior to 6.7 U3p and 6.5 prior to 6.5 U3r) and VMwa | CVEProject cvelistV5 (CNA) |
References and advisories
2- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22948 government-resource
- https://www.vmware.com/security/advisories/VMSA-2022-0009.html x_refsource_MISC
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2022-03-29
- Last updated
- 2025-10-22
- State
- Published
- Assigner (CNA)
- vmware
- Kolun priority
- 84 · Critical
CISA KEV catalog
- Date added
- 2024-07-17
- Due date
- 2024-08-07
- Used in ransomware
- Unknown
Exploit prediction (EPSS)
13.28%
Probability of exploitation in 30 days
96.3%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Active
- Technical impact
- Total
Weaknesses (CWE)
- CWE-276Incorrect Default Permissions