Support Content Notification - Support Portal

VMSA-2022-0009:VMware vCenter Server updates address an information disclosure vulnerability

Product/Component

VMware Cloud Foundation

1 more products

Notification Id

23623

Last Updated

16 May 2022

Initial Publication Date

27 March 2022

Status

CLOSED

Severity

MEDIUM

CVSS Base Score

5.5

WorkAround

Affected CVE

CVE-2022-22948

Advisory ID: VMSA-2022-0009.1

CVSSv3 Range: 5.5

Issue Date:2022-03-29

Updated On: 2022-05-18

CVE(s): CVE-2022-22948

Synopsis: VMware vCenter Server updates address an information disclosure vulnerability (CVE-2022-22948)

1. Impacted Products

VMware vCenter Server (vCenter Server)
VMware Cloud Foundation (Cloud Foundation)

2. Introduction

An information disclosure vulnerability in VMware vCenter Server was privately reported to VMware. Updates are available to remediate this vulnerability in affected VMware products.

3. vCenter Server information disclosure vulnerability (CVE-2022-22948)

Description

The vCenter Server contains an information disclosure vulnerability due to improper permission of files. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.5.

Known Attack Vectors

A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.

Resolution

To remediate CVE-2022-22948 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.

Workarounds

None.

Additional Documentation

None.

Notes

None.

Acknowledgements

VMware would like to thank Yuval Lazar (@Ul7raVi0l3t) of Pentera for reporting this issue to us.

Response Matrix:

Product	Version	Running On	CVE Identifier	CVSSv3	Severity	Fixed Version	Workarounds	Additional Documentation
vCenter Server	7.0	Any	CVE-2022-22948	5.5	moderate	7.0 U3d	None	None
vCenter Server	6.7	Virtual Appliance	CVE-2022-22948	5.5	moderate	6.7 U3p	None	None
vCenter Server	6.7	Windows	CVE-2022-22948	N/A	N/A	Unaffected	N/A	N/A
vCenter Server	6.5	Virtual Appliance	CVE-2022-22948	5.5	moderate	6.5 U3r	None	None
vCenter Server	6.5	Windows	CVE-2022-22948	N/A	N/A	Unaffected	N/A	N/A

Impacted Product Suites that Deploy Response Matrix Components:

Product	Version	Running On	CVE Identifier	CVSSv3	Severity	Fixed Version	Workarounds	Additional Documentation
Cloud Foundation (vCenter Server)	4.x	Any	CVE-2022-22948	5.5	moderate	4.4.1	None	None
Cloud Foundation (vCenter Server)	3.x	Any	CVE-2022-22948	5.5	moderate	3.11	None	None