CVE-2022-22982

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-07-13 · updated 2026-06-17
Weakness: CWE-918

Description

The vCenter Server contains a server-side request forgery (SSRF) vulnerability. A malicious actor with network access to 443 on the vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service.

Affected products

VMware Cloud Foundation: from 3.0 through 3.11; from 4.0 through 4.3.1
VMware vCenter Server: 6.5, 6.5-a, 6.5-b, 6.5-c, 6.5-d, 6.5-e (+61)
VMware vCenter Server: VMware vCenter Server (7.0 before 7.0 U3f, 6.7 before 6.7 U3r & 6.5 before 6.5 U3t)

References

https://www.vmware.com/security/advisories/VMSA-2022-0018.html
https://www.vmware.com/security/advisories/VMSA-2022-0018.html

Get alerted when CVE-2022-22982 or the next vulnerability affects your stack