by Kastro
Paper/Archive/CVE-2022-31680

CVE-2022-31680

vmware — The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller).

EPSS 31%CVSS 9.1
critical.is priorityof 100
47
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 98.3.983 × 2019.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller). A malicious actor with admin access on vCenter server may exploit this issue to execute arbitrary code on the underlying operating system that hosts the vCenter Server.

Affected

ProductAffectedFixed inSource
VMware vCenter ServerVMware vCenter Server 6.5 prior to U3u–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

refvmware.com/security/advisories/VMSA-2022-0025.htmlreftalosintelligence.com/vulnerability_reports/TALOS-2022-1587