VMSA-2022-0009

https://ift.tt/5HsyZFY

Moderate

Advisory ID: VMSA-2022-0009

CVSSv3 Range: 5.5

Issue Date: 2022-03-29

Updated On: 2022-03-29 (Initial Advisory)

CVE(s): CVE-2022-22948

Synopsis: VMware vCenter Server updates address an information disclosure vulnerability (CVE-2022-22948)

1. Impacted Products

VMware vCenter Server (vCenter Server)
VMware Cloud Foundation (Cloud Foundation)

2. Introduction

An information disclosure vulnerability in VMware vCenter Server was privately reported to VMware. Updates are available to remediate this vulnerability in affected VMware products.

3. vCenter Server information disclosure vulnerability (CVE-2022-22948)

Description

The vCenter Server contains an information disclosure vulnerability due to improper permission of files. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.5.

Known Attack Vectors

A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.

Resolution

To remediate CVE-2022-22948 apply the patches listed in the ‘Fixed Version’ column of the ‘Response Matrix’ found below.

Workarounds

None.

Additional Documentation

None.

Notes

None.

Acknowledgements

VMware would like to thank Yuval Lazar (@Ul7raVi0l3t) of Pentera for reporting this issue to us.

Response Matrix:

Product	Version	Running On	CVE Identifier	CVSSv3	Severity	Fixed Version	Workarounds	Additional Documentation
vCenter Server	7.0	Any	CVE-2022-22948	5.5	moderate	7.0 U3d	None	None
vCenter Server	6.7	Virtual Appliance	CVE-2022-22948	5.5	moderate	6.7 U3p	None	None
vCenter Server	6.7	Windows	CVE-2022-22948	N/A	N/A	Unaffected	N/A	N/A
vCenter Server	6.5	Virtual Appliance	CVE-2022-22948	5.5	moderate	6.5 U3r	None	None
vCenter Server	6.5	Windows	CVE-2022-22948	N/A	N/A	Unaffected	N/A	N/A

Impacted Product Suites that Deploy Response Matrix Components:

Product	Version	Running On	CVE Identifier	CVSSv3	Severity	Fixed Version	Workarounds	Additional Documentation
Cloud Foundation (vCenter Server)	4.x	Any	CVE-2022-22948	5.5	moderate	Patch pending	None	None
Cloud Foundation (vCenter Server)	3.x	Any	CVE-2022-22948	5.5	moderate	3.11	None	None