VMSA-2022-0003:VMware Cloud Foundation contains an information disclosure vulnerability due to the logging of plaintext credentials within some log files

Product/Component

VMware Cloud Foundation

0 more products

Notification Id

23629

Last Updated

12 February 2022

Initial Publication Date

29 January 2022

Status

CLOSED

Severity

MEDIUM

CVSS Base Score

6.0

WorkAround

Affected CVE

CVE-2022-22939

Advisory ID: VMSA-2022-0003.1

CVSSv3 Range: 6.0

Issue Date:2022-01-31

Updated On: 2022-02-14

CVE(s): CVE-2022-22939

Synopsis: VMware Cloud Foundation contains an information disclosure vulnerability due to the logging of plaintext credentials within some log files.

1. Impacted Products

VMware Cloud Foundation (Cloud Foundation)

2. Introduction

An Information disclosure vulnerability in VMware Cloud Foundation SDDC Manager was discovered. Updates are available to remediate this vulnerability in VMware Cloud Foundation.

3. Information disclosure vulnerability in VMware Cloud Foundation SDDC Manager (CVE-2022-22939)

Description

VMware Cloud Foundation contains an information disclosure vulnerability due to logging of credentials in plain-text within multiple log files on the SDDC Manager.

Known Attack Vectors

A malicious actor with root access on VMware Cloud Foundation SDDC Manager may be able to view credentials in plaintext within one or more log files.

Resolution

To remediate CVE-2022-22939 apply the updates listed in the 'Fixed Version' column of the 'Response Matrix' below to affected deployments.

Workarounds

Workarounds for CVE-2022-22939 have been listed in the 'Workarounds' column of the 'Response Matrix' below.

Additional Documentation

None.

Notes

None.

Acknowledgements

None.

Response Matrix

Product	Version	Running On	CVE Identifier	CVSSv3	Severity	Fixed Version	Workarounds	Additional Documentation
VMware Cloud Foundation	4.x	Any	CVE-2022-22939	6.0	moderate	4.3.1.1	KB87050	None.
VMware Cloud Foundation	3.x	Any	CVE-2022-22939	6.0	moderate	3.11	N/A	None.