PT-2022-24500 · Vmware · Vmware Hyperic Server

Published 2022-11-12 · Updated 2024-08-03 · CVE-2022-38650

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware Hyperic Server version 5.8.6

Description A remote unauthenticated insecure deserialization vulnerability exists, enabling a malicious party to run arbitrary code or malware within Hyperic Server and the host operating system with the privileges of the Hyperic server process. This issue only affects products that are no longer supported by the maintainer.

Recommendations For VMware Hyperic Server version 5.8.6, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-38650

Affected Products

Vmware Hyperic Server

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2022-38650 · Security Note
• https://osv.dev/vulnerability/CVE-2022-38650 · Vendor Advisory
• https://t.me/cvenotify/37927 · Telegram Post
• https://t.me/cvenotify/37571 · Telegram Post
• https://t.me/cvenotify/88759 · Telegram Post
• https://t.me/cvenotify/88761 · Telegram Post
• https://t.me/cvenotify/37925 · Telegram Post
• https://cyber.gov.au/acsc/view-all-content/alerts/multiple-vulnerabilities-vmware-vrealize-hyperic-monitoring-and-performance-management-product · Note
• https://t.me/cvenotify/82601 · Telegram Post
• https://t.me/cvenotify/37573 · Telegram Post
• https://t.me/cibsecurity/52900 · Telegram Post
• https://t.me/cvenotify/85117 · Telegram Post