CVE-2022-22966 Code injection in VMware Cloud Director
Authenticated high-privileged users can exploit a remote code execution vulnerability in VMware Cloud Director to gain server access.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-22966?
CVE-2022-22966 is a high-severity code injection vulnerability in VMware Cloud Director, published on 14 Apr 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An authenticated, high privileged malicious actor with network access to the VMware Cloud Director tenant or provider may be able to exploit a remote code execution vulnerability to gain access to the server.
Which versions are affected by CVE-2022-22966?
It affects 1 product.
Products include Vmware Vcloud Director.
How do I fix CVE-2022-22966?
No fix has been published for CVE-2022-22966 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-22966 being exploited?
There is no known exploitation of CVE-2022-22966 in the wild and no public exploit code.
Other vulnerabilities in VMware Cloud Director
Sources
Also known as GHSA-vjxq-3835-4p27.