9.1

CVE-2022-31680

Exploit
The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller). A malicious actor with admin access on vCenter server may exploit this issue to execute arbitrary code on the underlying operating system that hosts the vCenter Server.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
VMware ≫ vCenter Server Version < 6.5
VMware ≫ vCenter Server Version 6.5 Update -
VMware ≫ vCenter Server Version 6.5 Update a
VMware ≫ vCenter Server Version 6.5 Update b
VMware ≫ vCenter Server Version 6.5 Update c
VMware ≫ vCenter Server Version 6.5 Update d
VMware ≫ vCenter Server Version 6.5 Update update1
VMware ≫ vCenter Server Version 6.5 Update update1b
VMware ≫ vCenter Server Version 6.5 Update update1c
VMware ≫ vCenter Server Version 6.5 Update update1d
VMware ≫ vCenter Server Version 6.5 Update update1e
VMware ≫ vCenter Server Version 6.5 Update update1g
VMware ≫ vCenter Server Version 6.5 Update update2
VMware ≫ vCenter Server Version 6.5 Update update2b
VMware ≫ vCenter Server Version 6.5 Update update2c
VMware ≫ vCenter Server Version 6.5 Update update2d
VMware ≫ vCenter Server Version 6.5 Update update2g
VMware ≫ vCenter Server Version 6.5 Update update3
VMware ≫ vCenter Server Version 6.5 Update update3d
VMware ≫ vCenter Server Version 6.5 Update update3f
VMware ≫ vCenter Server Version 6.5 Update update3k
VMware ≫ vCenter Server Version 6.5 Update update3n
VMware ≫ vCenter Server Version 6.5 Update update3p
VMware ≫ vCenter Server Version 6.5 Update update3q
VMware ≫ vCenter Server Version 6.5 Update update3r
VMware ≫ vCenter Server Version 6.5 Update update3s
VMware ≫ vCenter Server Version 6.5 Update update3t
VMware ≫ vCenter Server Version 6.5 Update update3u
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 33.06% 0.981
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.1 2.3 6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1587
Third Party Advisory
Exploit
https://www.vmware.com/security/advisories/VMSA-2022-0025.html
Vendor Advisory