PT-2022-20894 · Vmware · Vcenter Server+1

Zachary Kern-Wies · Published 2022-12-13 · Updated 2022-12-15 · CVE-2022-31697

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions vCenter Server (affected versions not specified)

Description The vCenter Server contains an information disclosure issue due to the logging of credentials in plaintext. A malicious actor with access to a workstation that invoked a vCenter Server Appliance ISO operation (Install/Upgrade/Migrate/Restore) can access plaintext passwords used during that operation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2022-31697

Affected Products

Vmware Vcenter

Vcenter Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-31697 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31697 · Vendor Advisory
• https://vmware.com/security/advisories/VMSA-2022-0030.html · Vendor Advisory
• https://t.me/cibsecurity/54433 · Telegram Post