CVE-2022-22939

VMware Cloud Foundation contains an information disclosure vulnerability due to logging of credentials in plain-text within multiple log files on the SDDC Manager. A malicious actor with root access on VMware Cloud Foundation SDDC Manager may be able to view credentials in plaintext within one or more log files.

CVSS v3 4.9 MEDIUM
CVSS v2.0 4.0 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://www.vmware.com/security/advisories/VMSA-2022-0003.html	Release Notes Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:vmware:cloud_foundation::::::::
	cpe:2.3:o:vmware:cloud_foundation::::::::

History

No history.

Information

Published : 2022-02-04 23:15

Updated : 2024-02-28 18:48

NVD link : CVE-2022-22939

Mitre link : CVE-2022-22939

CVE.ORG link : CVE-2022-22939

JSON object : View

Products Affected

vmware

cloud_foundation

CWE

CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2022-22939", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "published": "2022-02-04T23:15:13.393", "references": [{"url": "https://www.vmware.com/security/advisories/VMSA-2022-0003.html", "tags": ["Release Notes", "Vendor Advisory"], "source": "security@vmware.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "VMware Cloud Foundation contains an information disclosure vulnerability due to logging of credentials in plain-text within multiple log files on the SDDC Manager. A malicious actor with root access on VMware Cloud Foundation SDDC Manager may be able to view credentials in plaintext within one or more log files."}, {"lang": "es", "value": "VMware Cloud Foundation contiene una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n debido al registro de credenciales en texto plano dentro de varios archivos de registro en el SDDC Manager. Un actor malicioso con acceso a root en VMware Cloud Foundation SDDC Manager puede ser capaz de visualizar las credenciales en texto plano dentro de uno o m\u00e1s archivos de registro"}], "lastModified": "2022-02-10T07:06:53.217", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CEBD9C21-C9E9-45EB-8370-B499C0B9290A", "versionEndIncluding": "3.10.2.2", "versionStartIncluding": "3.0"}, {"criteria": "cpe:2.3:o:vmware:cloud_foundation:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8DD4BE55-532A-4423-B658-4D658BA841AD", "versionEndIncluding": "4.1.0.1", "versionStartIncluding": "4.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@vmware.com"}