VMSA-2022-0017

Low

Advisory ID: VMSA-2022-0017

CVSSv3 Range: 2.7

Issue Date: 2022-06-15

Updated On: 2022-06-15 (Initial Advisory)

CVE(s): CVE-2022-22953

Synopsis: VMware HCX update addresses an information disclosure vulnerability (CVE-2022-22953)

1. Impacted Products

VMware HCX

2. Introduction

An information disclosure vulnerability in VMware HCX was privately reported to VMware. Updates are available to remediate this vulnerability in affected VMware products.

3. Advisory Details

Description

VMware HCX contains an information disclosure vulnerability. VMware has evaluated the severity of this issue to be in the low severity range with a maximum CVSSv3 base score of 2.7.

Known Attack Vectors

A malicious actor with network user access to the VMware HCX appliance may be able to gain access to sensitive information.

Resolution

To remediate CVE-2022-22953 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' below.

Workarounds

None.

Additional Documentation

None.

Notes

None.

Acknowledgements

VMware would like to thank Fernando Gallego of NCC Group for reporting this issue to us.

Response Matrix

Product	Version	Running On	CVE Identifier	CVSSv3	Severity	Fixed Version	Workarounds	Additional Documentation
VMware HCX	4.3.1 and 4.3.2	Any	CVE-2022-22953	2.7	low	4.3.3	None	None