Description
The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.
Metrics
CVSS 3.1 6.5/10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | VMware vCenter Server and VMware Cloud Foundation | VMware vCenter Server (7.0 prior to 7.0 U3d, 6.7 prior to 6.7 U3p and 6.5 prior to 6.5 U3r) and VMware Cloud Foundation (4.x and 3.x prior to 3.11) |
| vmware | cloud_foundation | >= 4.0, < 5.0 |
| vmware | cloud_foundation | >= 3.0, < 3.11 |
| vmware | vcenter_server | >= 7.0, < 7.0_u3d |
| vmware | vcenter_server | >= 6.7, < 6.7_u3p |
| vmware | vcenter_server | >= 6.5, < 6.5_u3r |
References
- https://www.vmware.com/security/advisories/VMSA-2022-0009.htmlPatch, Vendor Advisory
- https://www.vmware.com/security/advisories/VMSA-2022-0009.htmlPatch, Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22948US Government Resource
Timeline
- Published
- Mar 29, 2022
- Last modified
- Jun 17, 2026
- Added to CISA KEV
- Jul 17, 2024
- NVD status
- Analyzed