Support Content Notification - Support Portal

VMSA-2022-0015:VMware Tools for Windows update addresses an XML External Entity (XXE) vulnerability

Product/Component

VMware

0 more products

Notification Id

23631

Last Updated

22 May 2022

Initial Publication Date

22 May 2022

Status

CLOSED

Severity

MEDIUM

CVSS Base Score

5.8

WorkAround

Affected CVE

CVE-2022-22977

Advisory ID: VMSA-2022-0015

CVSSv3 Range: 5.8

Issue Date:2022-05-24

Updated On: 2022-05-24 (Initial Advisory)

CVE(s): CVE-2022-22977

Synopsis: VMware Tools for Windows update addresses an XML External Entity (XXE) vulnerability (CVE-2022-22977)

1. Impacted Products

VMware Tools for Windows (VMware Tools)

2. Introduction

An XML External Entity (XXE) vulnerability in VMware Tools for Windows was privately reported to VMware. Updates are available to remediate this vulnerability in affected VMware products.

3. XML External Entity (XXE) vulnerability (CVE-2022-22977)

Description

VMware Tools for Windows contains an XML External Entity (XXE) vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.8.

Known Attack Vectors

A malicious actor with non-administrative local user privileges in the Windows guest OS, where VMware Tools is installed, may exploit this issue leading to a denial-of-service condition or unintended information disclosure.

Resolution

To remediate CVE-2022-22977 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.

Workarounds

None.

Additional Documentation

None.

Notes

None.

Acknowledgements

VMware would like to thank ycdxsb of VARAS@IIE, Jake Baines of Rapid7 and Sascha Meyer of GAI NetConsult GmbH for reporting this issue to us.

Response Matrix

Product	Version	Running On	CVE Identifier	CVSSv3	Severity	Fixed Version	Workarounds	Additional Documentation
VMware Tools for Windows	12.0.0, 11.x.y and 10.x.y	Windows	CVE-2022-22977	5.8	moderate	12.0.5	None	None