CVE-2022-22983

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

VMware Workstation (16.x prior to 16.2.4) contains an unprotected storage of credentials vulnerability. A malicious actor with local user privileges to the victim machine may exploit this vulnerability leading to the disclosure of user passwords of the remote server connected through VMware Workstation.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published: Aug 10, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-229846.3The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk CVE-2022-229858.8The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code CVE-2022-229868.8Netcommunity OG410X and OG810X series (Netcommunity OG410Xa, OG410Xi, OG810Xa, and OG810Xi firmware Ver.2.28 and earlier) allow an attacker CVE-2022-229879.8The affected product has a hardcoded private key available inside the project folder, which may allow an attacker to achieve Web Server logi CVE-2022-229889.1File and directory permissions have been corrected to prevent unintended users from modifying or accessing resources. It would be more diffi CVE-2022-229899.8My Cloud OS 5 was vulnerable to a pre-authenticated stack overflow vulnerability on the FTP service that could be exploited by unauthenticat CVE-2022-22995.4The Allow SVG Files WordPress plugin through 1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author CVE-2022-229908.8A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate priv CVE-2022-229918.8A malicious user on the same LAN could use DNS spoofing followed by a command injection attack to trick a NAS device into loading through an CVE-2022-229929.8A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to e CVE-2022-229938.8A limited SSRF vulnerability was discovered on Western Digital My Cloud devices that could allow an attacker to impersonate a server and rea CVE-2022-229949.8A remote code execution vulnerability was discovered on Western Digital My Cloud devices where an attacker could trick a NAS device into loa