CVE-2022-22948: VMware vCenter Server Incorrect Default File Permissions Vulnerability

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: yes — in CISA KEV since 2024-07-17
EPSS: 13.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-03-29 · updated 2026-06-17
Weakness: CWE-276

Description

The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.

Affected products

VMware Cloud Foundation: from 3.0 before 3.11; from 4.0 before 4.4.1 — fixed in 3.11, 4.4.1
VMware vCenter Server: 6.5, 6.5-a, 6.5-b, 6.5-c, 6.5-d, 6.5-e (+55)
VMware Cloud Foundation: from 4.0 before 5.0 — fixed in 5.0
VMware vCenter Server: from 7.0 before 7.0_u3d — fixed in 7.0_u3d
VMware vCenter Server and VMware Cloud Foundation: from VMware vCenter Server (7.0 prior through 7.0 U3d, 6.7 prior to 6.7 U3p and 6.5 prior to 6.5 U3r) and VMware Cloud Foundation (4.x and 3.x prior to 3.11)

How to fix

Upgrade to a fixed version: VMware Cloud Foundation 3.11, 4.4.1; VMware Cloud Foundation 5.0; VMware vCenter Server 7.0_u3d. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-22948 or the next vulnerability affects your stack