File Upload Vulnerability in VMware Carbon Black App Control
CVE-2022-22952

9.1CRITICAL

Key Information:

Vendor

Vmware
Status
Vmware Carbon Black App Control (appc)
Vendor
CVE Published:
23 March 2022

What is CVE-2022-22952?

VMware Carbon Black App Control versions prior to 8.5.14, 8.6.6, 8.7.4, and 8.8.2 are affected by a file upload vulnerability. This flaw allows a malicious actor with administrative access to the App Control administration interface to upload a specially crafted file, potentially leading to code execution on the Windows instance where the AppC Server is installed. This poses significant risks to the integrity and security of the affected systems, emphasizing the need for timely updates and patching.

Affected Version(s)

VMware Carbon Black App Control (AppC) VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2)

References

https://www.vmware.com/security/advisories/VMSA-2022-0008...
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.