VMware Patches Sensitive Information Disclosure Vulnerability in vCenter Server (CVE-2022-22948)

On March 29, VMware patched a moderate severity flaw in VMware vCenter Server, its centralized management software for VMware vSphere cloud computing virtualization systems

The flaw, identified as CVE-2022-22948, is an information disclosure vulnerability. An authenticated, local attacker with low-privileged user access could exploit the flaw to obtain sensitive information from the vCenter Server. While not considered severe on its own, when included as part of an attack chain with other VMware vCenter exploits, it could result in a full server takeover.

For more information about the vulnerability, including the availability of patches and Tenable product coverage, please visit our blog.