{"id":"CVE-2022-22948","published":"2022-03-29T18:15:08Z","modified":"2026-06-17T04:29:13Z","title":"VMware vCenter Server Incorrect Default File Permissions Vulnerability","vendor":"VMware","product":"vCenter Server","tier":"core","eol":null,"description":{"text":"The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.","provenance":"source","from":"NVD"},"summary":{"text":"Sentence 1: VMware vCenter Server contains an information disclosure flaw caused by improperly set file permissions. Sentence 2: An attacker with non-administrative access to the vCenter Server, reachable over the network without user interaction, can read sensitive information.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:11:19Z"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.13282,"percentile":0.96379,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2024-07-17","dueDate":"2024-08-07","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.vmware.com/security/advisories/VMSA-2022-0009.html;  https://nvd.nist.gov/vuln/detail/CVE-2022-22948","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-06-18","exploitedFirstSeen":"2024-06-18","ransomware":false,"evidence":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations","date":"2024-06-18"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-07-17"},{"url":"https://blog.qualys.com/vulnerabilities-threat-research/2025/05/08/inside-lockbit-defense-lessons-from-the-leaked-lockbit-negotiations","date":"2025-05-08"},{"url":"https://www.trendmicro.com/en_no/research/25/g/revisiting-unc3886-tactics-to-defend-against-present-risk.html","date":"2025-07-28"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-276","name":"Incorrect Default Permissions"}],"references":[{"url":"https://www.vmware.com/security/advisories/VMSA-2022-0009.html","tags":["Patch","Vendor Advisory"]},{"url":"https://www.vmware.com/security/advisories/VMSA-2022-0009.html","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22948","tags":["US Government Resource"]}],"techniques":[{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Default Configuration","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited by an adversary who has gained access to a valid account on the vCenter Server. The adversary can gain access to unencrypted Postgres credentials on the server, which grants the adversary access to the vCenter's internal database where the vpxuser account passphrase is stored. Adversaries can leverage this information to decrypt the vpxuser password, which will grant them root privileges. ","confidence":"high"},{"id":"T1212","name":"Exploitation for Credential Access","tactics":["credential-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Default Configuration","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited by an adversary who has gained access to a valid account on the vCenter Server. The adversary can gain access to unencrypted Postgres credentials on the server, which grants the adversary access to the vCenter's internal database where the vpxuser account passphrase is stored. Adversaries can leverage this information to decrypt the vpxuser password, which will grant them root privileges. ","confidence":"high"},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Default Configuration","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability is exploited by an adversary who has gained access to a valid account on the vCenter Server. The adversary can gain access to unencrypted Postgres credentials on the server, which grants the adversary access to the vCenter's internal database where the vpxuser account passphrase is stored. Adversaries can leverage this information to decrypt the vpxuser password, which will grant them root privileges. ","confidence":"high"}],"reports":[{"id":"SRC-d520834e84b63932946c","title":"Cloaked and Covert: Uncovering UNC3886 Espionage Operations","publisher":"cloud.google.com","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations","date":null,"mentions":[{"quote":"CVE-2022-22948 in VMware vCenter was exploited to obtain encrypted credentials in the vCenter's postgresDB for further access.","start":3383,"end":3509}]},{"id":"SRC-348e3b6201160b38a1f1","title":"VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors","publisher":"cloud.google.com","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass","date":null,"mentions":[{"quote":"In March 2022, Pentera researcher Yuval Lazar published guidance related to the privilege escalation vulnerability, CVE-2022-22948, which described how the vpxuser credentials can be harvested on a vCenter server.","start":5893,"end":6106}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-28072","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-28072","exploited":true,"exploitedSince":"2024-07-17","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2021-10-17","earliestUrl":"https://github.com/PenteraIO/CVE-2022-22948","repos":[{"name":"PenteraIO/CVE-2022-22948","url":"https://github.com/PenteraIO/CVE-2022-22948","stars":11,"created":"2021-10-17"}]},"metasploit":[{"name":"VMware vCenter Secrets Dump","module":"post/linux/gather/vcenter_secrets_dump","type":"post","disclosureDate":"2022-04-15","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/post/linux/gather/vcenter_secrets_dump.rb"}],"first":{"date":"2021-10-17","source":"PoC-in-GitHub","url":"https://github.com/PenteraIO/CVE-2022-22948"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1078"],"provenance":"source"},{"stage":"primary","techniques":["T1212"],"provenance":"source"},{"stage":"secondary","techniques":["T1068"],"provenance":"source"}],"timeline":[{"date":"2021-10-17","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2022-04-15","url":"https://github.com/PenteraIO/CVE-2022-22948","provenance":"source"},{"date":"2022-03-29","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22948","provenance":"source"},{"date":"2024-06-18","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations","provenance":"source"},{"date":"2024-07-17","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-07-17","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-28072","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":841},"priority":{"score":73.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 863 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.28,"detail":"percentile 0.9638"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":4.55,"detail":"base score 6.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}