CVE-2022-31708

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

vRealize Operations (vROps) contains a broken access control vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 4.4.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
n/a	VMware vRealize Operations (vROps)	VMware vRealize Operations (vROps) (Multiple Versions)

References

https://www.vmware.com/security/advisories/VMSA-2022-0034.htmlPatch, Vendor Advisory
https://www.vmware.com/security/advisories/VMSA-2022-0034.htmlPatch, Vendor Advisory

Timeline

Published: Dec 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-31717.5A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of CVE-2022-317107.5vRealize Log Insight contains a deserialization vulnerability. An unauthenticated malicious actor can remotely trigger the deserialization o CVE-2022-317115.3VMware vRealize Log Insight contains an Information Disclosure Vulnerability. A malicious actor can remotely collect sensitive session and a CVE-2022-31728.2A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could CVE-2022-31734.3Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10.CVE-2022-317339.1Starting with diego-release 2.55.0 and up to 2.69.0, and starting with CF Deployment 17.1 and up to 23.2.0, apps are accessible via another CVE-2022-317346.1Cisco Catalyst 2940 Series Switches provided by Cisco Systems, Inc. contain a reflected cross-site scripting vulnerability regarding error p CVE-2022-317356.1OpenAM Consortium Edition version 14.0.0 provided by OpenAM Consortium contains an open redirect vulnerability (CWE-601). When accessing an CVE-2022-317369.8A malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerability affects Thunder CVE-2022-317379.8A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash. Thi CVE-2022-317386.5When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user c CVE-2022-317398.8When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-