CVE-2022-22948 — VMware vCenter Server Incorrect Default File Permissions Vulnerability
CVE-2022-22948: VMware vCenter Server Incorrect Default File Permissions Vulnerability
CISA Known Exploited Vulnerability (KEV)
| Vendor / project | VMware |
| Product | vCenter Server |
| Date added | 2024-07-17 |
| Due date | 2024-08-07 |
| Ransomware campaign use | Unknown |
Description
VMware vCenter Server contains an incorrect default file permissions vulnerability that allows a remote, privileged attacker to gain access to sensitive information.
Required action (CISA)
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes
https://www.vmware.com/security/advisories/VMSA-2022-0009.html; https://nvd.nist.gov/vuln/detail/CVE-2022-22948
References
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2022-22948
- KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog