CVE-2022-22977
7.1 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
6.6 Medium
AI Score
Confidence
High
3.6 Low
CVSS2
Access Vector
Access Complexity
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:N/A:P
0.0004 Low
EPSS
Percentile
5.2%
VMware Tools for Windows(12.0.0, 11.x.y and 10.x.y) contains an XML External Entity (XXE) vulnerability. A malicious actor with non-administrative local user privileges in the Windows guest OS, where VMware Tools is installed, may exploit this issue leading to a denial-of-service condition or unintended information disclosure.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| vmware:tools | vmware tools | le | 10.3.24 |
| vmware:tools | vmware tools | le | 11.3.5 |
| vmware:tools | vmware tools | lt | 12.0.5 |
CNA Affected
[
{
"product": "VMware Tools for Windows",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "VMware Tools for Windows (12.0.0, 11.x.y and 10.x.y)"
}
]
}
]Social References
More
Related
7.1 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
6.6 Medium
AI Score
Confidence
High
3.6 Low
CVSS2
Access Vector
Access Complexity
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:N/A:P
0.0004 Low
EPSS
Percentile
5.2%