PT-2022-2239 · Vmware · Vmware Cloud Director

Jari Jääskelä + 1 · Published 2022-04-14 · Updated 2022-04-22 · CVE-2022-22966

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VMware vCloud Director (affected versions not specified)

Description The issue is related to insufficient input validation in the VMware vCloud Director platform, which can be exploited by a remote attacker to execute arbitrary code. An authenticated, high-privileged malicious actor with network access to the VMware Cloud Director tenant or provider may exploit this vulnerability to gain access to the server. This can potentially allow attackers to gain access to sensitive data and take over private clouds within an entire infrastructure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-02335

CVE-2022-22966

Affected Products

Vmware Cloud Director

References · 6

• https://bdu.fstec.ru/vul/2022-02335 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22966 · Vendor Advisory
• https://vmware.com/security/advisories/VMSA-2022-0013.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22966 · Security Note
• https://kb.vmware.com/s/article/88176 · Note
• https://t.me/thehackernews/2088 · Telegram Post