PT-2022-4285 · Vmware · Vmware Tools

Jake Baines + 2 · Published 2022-05-04 · Updated 2022-06-09 · CVE-2022-22977

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions VMware Tools for Windows versions 10.x.y through 12.0.0

Description The issue is related to an XML External Entity (XXE) vulnerability. A malicious actor with non-administrative local user privileges in the Windows guest OS, where VMware Tools is installed, may exploit this issue leading to a denial-of-service condition or unintended information disclosure.

Recommendations For versions 10.x.y through 12.0.0, consider disabling the XML parsing functionality until a patch is available. As a temporary workaround, restrict access to the VMware Tools to minimize the risk of exploitation. Avoid using the vulnerable XML functionality in the affected Windows guest OS until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2022-05139

CVE-2022-22977

Affected Products

Vmware Tools

References · 7

• https://vmware.com/security/advisories/VMSA-2022-0015.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22977 · Security Note
• https://bdu.fstec.ru/vul/2022-05139 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22977 · Vendor Advisory
• https://t.me/cvenotify/30650 · Telegram Post
• https://vuldb.com/ru/?id.200648 · Note
• https://t.me/cibsecurity/43298 · Telegram Post