Security readout for executives and security teams
Plain-English summary
CVE-2022-22948 lets a non-administrative user on VMware vCenter Server potentially read sensitive information because some files have improper permissions. It is not a takeover vulnerability by itself, but it affects a central virtualization management platform and is listed in CISA KEV, so exposed legacy systems deserve urgent attention.
Executive priority
Prioritize remediation because vCenter manages critical virtualization infrastructure and CISA confirms known exploitation. Treat this as an urgent confidentiality risk for legacy VMware environments, not as an immediate full-compromise finding based on the provided evidence.
Technical view
The issue is CWE-276 improper file permissions in VMware vCenter Server. CVSS 3.1 is 6.5: network-accessible, low complexity, low privileges required, no user interaction, high confidentiality impact, no integrity or availability impact. Affected versions include vCenter 7.0 before U3d, 6.7 before U3p, 6.5 before U3r, and listed VMware Cloud Foundation versions.
Likely exposure
Organizations running affected vCenter Server or VMware Cloud Foundation builds are exposed, especially where non-administrative vCenter access exists. Internet exposure is not required by the CVSS vector, but reachable management networks increase practical risk.
Exploitation context
CISA KEV listing indicates known exploitation. The provided sources do not describe exploitation scale, exploit method, payloads, or whether exploitation is currently active in the wild.
Researcher notes
Focus validation on version state, vCenter access control, and evidence of sensitive-file exposure by low-privileged users. The source bundle does not provide file paths, exploit details, workarounds, or indicators of compromise.
Mitigation direction
- Upgrade vCenter Server to 7.0 U3d, 6.7 U3p, or 6.5 U3r as applicable.
- For VMware Cloud Foundation, follow VMware VMSA-2022-0009 fixed-version guidance.
- Restrict vCenter access to trusted administrators and required management networks.
- Review non-administrative vCenter accounts and remove unnecessary access.
- Monitor VMware and CISA guidance for any additional remediation instructions.
Validation and detection
- Inventory all vCenter Server and VMware Cloud Foundation versions.
- Confirm affected builds are upgraded beyond the vulnerable version thresholds.
- Verify non-administrative vCenter accounts are still business-justified.
- Check whether vCenter management interfaces are reachable from untrusted networks.
- Review logs for unusual non-admin access to sensitive vCenter resources.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-276: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-22948 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N2.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.vmware.com/security/advisories/VMSA-2022-0009.htmlCVE reference · x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22948CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Default Permissions
Incorrect Default Permissions represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.