CVE-2022-22948: VMware vCenter Server and VMware Cloud Foundation

Описание

Оригинално описание

The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.

Засегнати продукти

• n/a VMware vCenter Server and VMware Cloud Foundation: VMware vCenter Server (7.0 prior to 7.0 U3d, 6.7 prior to 6.7 U3p and 6.5 prior to 6.5 U3r) and VMware Cloud Foundation (4.x and 3.x prior to 3.11)
• vmware cloud_foundation: 4.0 преди 5.0
• vmware vcenter_server: 7.0 преди 7.0_u3d

Вид слабост

• CWE-276 Неправилни права по подразбиране

История

Други уязвимости в n/a VMware vCenter Server and VMware Cloud Foundation

• 4.3CVE-2024-38815
• 6.7CVE-2024-38818
• 6.7CVE-2024-38817
• 6.8CVE-2024-37085
• 7.8CVE-2024-37081

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2022-22948
• https://nvd.nist.gov/vuln/detail/CVE-2022-22948
• https://www.vmware.com/security/advisories/VMSA-2022-0009.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22948