PT-2022-4219 · Vmware · Vmware Vrealize Operations

Mr_Me + 1 · Published 2022-08-09 · Updated 2023-08-08 · CVE-2022-31673

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware vRealize Operations (affected versions not specified)

Description The issue is related to an information disclosure vulnerability in the monitoring tool for virtual infrastructure. It allows a remote attacker to disclose protected information. A malicious actor with low privileges and network access can create and leak hex dumps, leading to information disclosure, and potentially to remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

BDU:2022-05067

CVE-2022-31673

Affected Products

Vmware Vrealize Operations

References · 4

• https://vmware.com/security/advisories/VMSA-2022-0022.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31673 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31673 · Security Note
• https://bdu.fstec.ru/vul/2022-05067 · Security Note