VMware Releases Security Updates

VMware has released security updates to address multiple vulnerabilities in VMware Cloud Foundation. A remote attacker could exploit one of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review VMware Security Advisory VMSA-2022-002 and...

CVE-2022-31678

VMware Cloud Foundation NSX-V contains an XML External Entity XXE vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to exploit this issue leading to a denial-of-service condition or unintended information disclosure...

CVE-2022-31678

VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability due to incorrect restrictions on XML references to external objects. This flaw affects VCF 3.x instances with NSX-V deployed and can be exploited by a user or unauthenticated malicious actor to trigger service fai...

VMware NSX For vSphere (NSX-v) Unsupported Detection

The VMware NSX for vSphere NSX-v appliance is no longer supported. Lack of support implies that no security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities. %NASLMINLEVEL 80900 C Tenable Network Security, Inc...

VMware Cloud Foundation code-related vulnerabilities

VMware Cloud Foundation is an all-in-one hybrid cloud platform from VMware. The platform includes features such as operations automation, infrastructure auto-configuration and integrated lifecycle management. A security vulnerability exists in VMware Cloud Foundation NSX-V that stems from the...

CVE-2022-31678: Improper Restriction of XML External Entity Reference

VMware Cloud Foundation NSX-V contains an XML External Entity XXE vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to exploit this issue leading to a denial-of-service condition or unintended information disclosure...

CVE-2021-39144: VMware Cloud Foundation Unauthenticated Remote Code Execution

On October 25, 2022, VMware published VMSA-2022-0027 on two vulnerabilities in its Cloud Foundation NSX-V solution. By far the more severe of these is CVE-2021-39144, an unauthenticated remote code execution vulnerability with a CVSSv3 score of 9.8. The vulnerability arises from a deserialization...

Researchers Expose Over 80 ShadowPad Malware C2 Servers

As many as 85 command-and-control C2 servers have been discovered supported by the ShadowPad malware since September 2021, with infrastructure detected as recently as October 16, 2022. That's according to VMware's Threat Analysis Unit TAU, which studied three ShadowPad variants using TCP, UDP, an...

Vulnerabilities fixed in VMware Cloud Foundation

VMware has fixed vulnerabilities in NSX-V as used by VMware Cloud Foundation. An unauthenticated malicious person can exploit the exploit the vulnerabilities to cause a denial-of-service or execute arbitrary code with privileges of root. This requires sending malicious network traffic to a...

VMware Releases Patch for Critical RCE Flaw in Cloud Foundation Platform

VMware on Tuesday shipped security updates to address a critical security flaw in its VMware Cloud Foundation product. Tracked as CVE-2021-39144, the issue has been rated 9.8 out of 10 on the CVSS vulnerability scoring system, and relates to a remote code execution vulnerability via XStream open...

XStream Code Execution

The vulnerability of the XStream library for converting objects to XML or JSON format in the VMware Cloud Foundation platform is related to deserialization errors and the ability to execute arbitrary code. Exploiting this vulnerability allows a malicious actor to execute arbitrary code with root...

VMware Cloud Foundation updates address multiple vulnerabilities.

3a. VMware Cloud Foundation update addresses a remote code execution vulnerability via XStream CVE-2021-39144 VMware Cloud Foundation contains a remote code execution vulnerability via XStream open source library. VMware has evaluated the severity of this issue to be in the Critical severity rang...

VMware NSX Manager XStream unauthenticated RCE

VMware Cloud Foundation NSX-V contains a remote code execution vulnerability via XStream open source library. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8. Due to an unauthenticated endpoint that leverages XStream for...

Multiple Campaigns Exploit VMware Vulnerability to Deploy Crypto Miners and Ransomware

A now-patched vulnerability in VMware Workspace ONE Access has been observed being exploited to deliver both cryptocurrency miners and ransomware on affected machines. "The attacker intends to utilize a victim's resources as much as possible, not only to install RAR1Ransom for extortion, but also...

VMware Reactor Netty security vulnerability

VMware Reactor Netty is a VMware USA company that provides non-blocking and backpressure-ready TCP/HTTP/UDP/QUIC clients and servers based on the Netty framework. A security vulnerability exists in VMware Reactor Netty versions 1.0.11 through 1.0.23, which stems from logging headers in the presen...

VMSA-2022-0027:VMware Cloud Foundation updates address multiple vulnerabilities

Advisory ID: VMSA-2022-0027.2 CVSSv3 Range: 5.3-9.8 Issue Date:2022-10-25 Updated On: 2023-03-09 CVEs: CVE-2021-39144, CVE-2022-31678 Synopsis: VMware Cloud Foundation updates address multiple vulnerabilities. RSS Feed Download PDF Download Text File Share this page on social media: 1. Impacted...

VMware could not fix a vulnerability that has been disclosed for eleven months

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary VMware disclosed a vulnerability in November 2021 that has not been fixed as of October 2022. VMware initially patched this vulnerability, but later discovered that it did not fix it. The...

VMware vCenter Server 6.5 < 6.5 U3u RCE (VMSA-2022-0025)

The version of VMware vCenter Server installed on the remote host is 6.5 prior to 6.5 U3u. It is, therefore, affected by a remote code execution vulnerability due to unsafe deserialization. A remote attacker with admin privileges on the affected server can exploit this vulnerability to execute...

VMware vCenter Server Code Execution

The vulnerability of the PSC platform’s control module, a software component for managing virtual infrastructure such as VMware vCenter Server, is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary cod...

Hitachi Storage Privilege Escalation

The vulnerability of Hitachi Storage’s module for VMware vCenter is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain increased privileges within the system...