CVE-2022-22951

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains an OS command injection vulnerability. An authenticated, high privileged malicious actor with network access to the VMware App Control administration interface may be able to execute commands on the server due to improper input validation leading to remote code execution.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	VMware Carbon Black App Control (AppC)	VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2)

References

https://www.vmware.com/security/advisories/VMSA-2022-0008.htmlPatch, Vendor Advisory
https://www.vmware.com/security/advisories/VMSA-2022-0008.htmlPatch, Vendor Advisory

Timeline

Published: Mar 23, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-229529.1VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains a file CVE-2022-229536.5VMware HCX update addresses an information disclosure vulnerability. A malicious actor with network user access to the VMware HCX appliance CVE-2022-229549.8VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A mali CVE-2022-229559.8VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A m CVE-2022-229569.8VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A m CVE-2022-229577.2VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CV CVE-2022-229587.2VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CV CVE-2022-229594.3VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a cross site request forgery vulnerability. A malicious actor CVE-2022-22968.8Use after free in Chrome OS Shell in Google Chrome on Chrome OS prior to 103.0.5060.114 allowed a remote attacker who convinced a user to en CVE-2022-229607.8VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissio CVE-2022-229615.3VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an information disclosure vulnerability due to returning exces CVE-2022-229627.8VMware Horizon Agent for Linux (prior to 22.x) contains a local privilege escalation as a user is able to change the default shared folder l