VMware Cloud Foundation SDDC Manager Information Disclosure (VMSA-2022-0003)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(302872);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/19");

  script_cve_id("CVE-2022-22939");
  script_xref(name:"IAVA", value:"2022-A-0057");

  script_name(english:"VMware Cloud Foundation SDDC Manager Information Disclosure (VMSA-2022-0003)");

  script_set_attribute(attribute:"synopsis", value:
"A hybrid cloud platform on the remote host is affected by an information disclosure vulnerability.");
  script_set_attribute(attribute:"description", value:
"The remote host is running a version of VMware Cloud Foundation prior to 3.11 or prior to 4.3.1.1.
It is, therefore, affected by an information disclosure vulnerability:

  - VMware Cloud Foundation contains an information disclosure vulnerability due to the logging of
    credentials in plain-text within multiple log files on the SDDC Manager. A malicious actor with
    root access on VMware Cloud Foundation SDDC Manager may be able to view credentials in plaintext
    within one or more log files.

Note that Nessus has not tested for this issue but has instead relied only on the application's
self-reported version number.");
  script_set_attribute(attribute:"see_also", value:"https://www.vmware.com/security/advisories/VMSA-2022-0003.html");
  script_set_attribute(attribute:"solution", value:
"Upgrade VMware Cloud Foundation to version 3.11 or 4.3.1.1 with Hotpatch KB87050 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-22939");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/01/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2022/01/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/03/18");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:vmware:cloud_foundation");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("vmware_cloud_foundation_installed.nbin", "vmware_cloud_foundation_web_detect.nbin");
  script_require_keys("installed_sw/VMware Cloud Foundation");

  exit(0);
}

include('vcf.inc');

var app_info = vcf::get_app_info(app:"VMware Cloud Foundation");

var constraints = [
  {'min_version': '3.0.0.0', 'fixed_version': '3.11.0.0'},
  {'min_version': '4.0.0.0', 'max_version': '4.3.1.0', 'fixed_display': '4.3.1.1 with Hot Patch KB87050'},
  {'equal':'4.3.1.1', 'fixed_display':'4.3.1.1 with Hot Patch KB87050', 'require_paranoia': TRUE}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);