Detections
Analytics
VMware vCenter Server 6.5 / 6.7 / 7.0 Information Disclosure (VMSA-2022-0009)
medium Nessus Plugin ID 159306
Language:
Synopsis
A virtualization management application installed on the remote host is affected by an information disclosure vulnerability.Description
The version of VMware vCenter Server installed on the remote host is 6.5 prior to 6.5 U3r, 6.7 prior to 6.7 U3p, or 7.0 prior to 7.0 U3d. It is, therefore, affected by an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. Nessus has also not tested for the presence of a workaround.
Solution
Upgrade to VMware vCenter Server 6.5 U3r, 6.7 U3p, or 7.0 U3d or later.See Also
https://www.vmware.com/security/advisories/VMSA-2022-0009.html
https://www.pentera.io/blog/information-disclosure-in-vmware-vcenter/
Plugin Details
Severity: Medium
ID: 159306
File Name: vmware_vcenter_vmsa-2022-0009.nasl
Version: 1.7
Type: remote
Family: Misc.
Published: 3/29/2022
Updated: 7/17/2024
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.1
CVSS v2
Risk Factor: Medium
Base Score: 4
Temporal Score: 3.3
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N
CVSS Score Source: CVE-2022-22948
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 6
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:vmware:vcenter_server
Required KB Items: Host/VMware/release, Host/VMware/version, Host/VMware/vCenter
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 3/29/2022
Vulnerability Publication Date: 3/29/2022
CISA Known Exploited Vulnerability Due Dates: 8/7/2024
Reference Information
CVE: CVE-2022-22948
IAVA: 2022-A-0127-S