Read the docs
TI-2022-07157 Aliases CVE-2022-22982GHSA-cvx4-254w-9ppg

Server-side request forgery in VMware vCenter Server

Priority LOW 35CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

The vCenter Server contains a server-side request forgery (SSRF) vulnerability. A malicious actor with network access to 443 on the vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service.

Why it matters now

EPSS 0.0104 64th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—VMware vCenter ServerVMware vCenter Server (7.0 before 7.0 U3f, 6.7 before 6.7 U3r & 6.5 before 6.5 U3t)—No fix listedCNA
  • VMware vCenter Server Vendor— Affected VMware vCenter Server (7.0 before 7.0 U3f, 6.7 before 6.7 U3r & 6.5 before 6.5 U3t) Fixed in — No fix listed CNA

CPE configurations NVD · 68

CPEVersionsRoleVendor
cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*3.0 – 3.11; 4.0 – 4.3.1VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:-:*:*:*:*:*:*6.5VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:a:*:*:*:*:*:*6.5 aVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:b:*:*:*:*:*:*6.5 bVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:c:*:*:*:*:*:*6.5 cVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:d:*:*:*:*:*:*6.5 dVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:e:*:*:*:*:*:*6.5 eVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:f:*:*:*:*:*:*6.5 fVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update1:*:*:*:*:*:*6.5 update1VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update1b:*:*:*:*:*:*6.5 update1bVulnerableVMware
  • cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* Versions 3.0 – 3.11; 4.0 – 4.3.1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:-:*:*:*:*:*:* Versions 6.5 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:a:*:*:*:*:*:* Versions 6.5 a Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:b:*:*:*:*:*:* Versions 6.5 b Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:c:*:*:*:*:*:* Versions 6.5 c Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:d:*:*:*:*:*:* Versions 6.5 d Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:e:*:*:*:*:*:* Versions 6.5 e Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:f:*:*:*:*:*:* Versions 6.5 f Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update1:*:*:*:*:*:* Versions 6.5 update1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update1b:*:*:*:*:*:* Versions 6.5 update1b Vulnerable ·VMware
Show 58 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:vmware:vcenter_server:6.5:update1c:*:*:*:*:*:*6.5 update1cVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update1d:*:*:*:*:*:*6.5 update1dVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update1e:*:*:*:*:*:*6.5 update1eVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update1g:*:*:*:*:*:*6.5 update1gVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update2:*:*:*:*:*:*6.5 update2VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update2b:*:*:*:*:*:*6.5 update2bVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update2c:*:*:*:*:*:*6.5 update2cVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update2d:*:*:*:*:*:*6.5 update2dVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update2g:*:*:*:*:*:*6.5 update2gVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update3:*:*:*:*:*:*6.5 update3VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update3d:*:*:*:*:*:*6.5 update3dVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update3f:*:*:*:*:*:*6.5 update3fVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update3k:*:*:*:*:*:*6.5 update3kVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update3n:*:*:*:*:*:*6.5 update3nVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update3p:*:*:*:*:*:*6.5 update3pVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update3q:*:*:*:*:*:*6.5 update3qVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update3r:*:*:*:*:*:*6.5 update3rVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update3s:*:*:*:*:*:*6.5 update3sVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:-:*:*:*:*:*:*6.7VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:a:*:*:*:*:*:*6.7 aVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:b:*:*:*:*:*:*6.7 bVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:d:*:*:*:*:*:*6.7 dVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update1:*:*:*:*:*:*6.7 update1VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update1b:*:*:*:*:*:*6.7 update1bVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update2:*:*:*:*:*:*6.7 update2VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update2a:*:*:*:*:*:*6.7 update2aVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update2c:*:*:*:*:*:*6.7 update2cVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update3:*:*:*:*:*:*6.7 update3VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update3a:*:*:*:*:*:*6.7 update3aVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update3b:*:*:*:*:*:*6.7 update3bVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update3f:*:*:*:*:*:*6.7 update3fVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update3g:*:*:*:*:*:*6.7 update3gVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update3j:*:*:*:*:*:*6.7 update3jVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update3l:*:*:*:*:*:*6.7 update3lVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update3m:*:*:*:*:*:*6.7 update3mVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update3n:*:*:*:*:*:*6.7 update3nVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update3o:*:*:*:*:*:*6.7 update3oVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update3p:*:*:*:*:*:*6.7 update3pVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update3q:*:*:*:*:*:*6.7 update3qVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:*7.0VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:*7.0 aVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:*7.0 bVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:*7.0 cVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:*7.0 dVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:*7.0 update1VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:*7.0 update1aVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update1c:*:*:*:*:*:*7.0 update1cVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update1d:*:*:*:*:*:*7.0 update1dVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update2:*:*:*:*:*:*7.0 update2VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update2a:*:*:*:*:*:*7.0 update2aVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update2b:*:*:*:*:*:*7.0 update2bVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update2c:*:*:*:*:*:*7.0 update2cVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update2d:*:*:*:*:*:*7.0 update2dVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3:*:*:*:*:*:*7.0 update3VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3a:*:*:*:*:*:*7.0 update3aVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3c:*:*:*:*:*:*7.0 update3cVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3d:*:*:*:*:*:*7.0 update3dVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3e:*:*:*:*:*:*7.0 update3eVulnerableVMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update1c:*:*:*:*:*:* Versions 6.5 update1c Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update1d:*:*:*:*:*:* Versions 6.5 update1d Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update1e:*:*:*:*:*:* Versions 6.5 update1e Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update1g:*:*:*:*:*:* Versions 6.5 update1g Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update2:*:*:*:*:*:* Versions 6.5 update2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update2b:*:*:*:*:*:* Versions 6.5 update2b Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update2c:*:*:*:*:*:* Versions 6.5 update2c Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update2d:*:*:*:*:*:* Versions 6.5 update2d Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update2g:*:*:*:*:*:* Versions 6.5 update2g Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update3:*:*:*:*:*:* Versions 6.5 update3 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update3d:*:*:*:*:*:* Versions 6.5 update3d Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update3f:*:*:*:*:*:* Versions 6.5 update3f Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update3k:*:*:*:*:*:* Versions 6.5 update3k Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update3n:*:*:*:*:*:* Versions 6.5 update3n Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update3p:*:*:*:*:*:* Versions 6.5 update3p Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update3q:*:*:*:*:*:* Versions 6.5 update3q Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update3r:*:*:*:*:*:* Versions 6.5 update3r Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update3s:*:*:*:*:*:* Versions 6.5 update3s Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:-:*:*:*:*:*:* Versions 6.7 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:a:*:*:*:*:*:* Versions 6.7 a Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:b:*:*:*:*:*:* Versions 6.7 b Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:d:*:*:*:*:*:* Versions 6.7 d Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update1:*:*:*:*:*:* Versions 6.7 update1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update1b:*:*:*:*:*:* Versions 6.7 update1b Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update2:*:*:*:*:*:* Versions 6.7 update2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update2a:*:*:*:*:*:* Versions 6.7 update2a Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update2c:*:*:*:*:*:* Versions 6.7 update2c Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update3:*:*:*:*:*:* Versions 6.7 update3 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update3a:*:*:*:*:*:* Versions 6.7 update3a Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update3b:*:*:*:*:*:* Versions 6.7 update3b Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update3f:*:*:*:*:*:* Versions 6.7 update3f Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update3g:*:*:*:*:*:* Versions 6.7 update3g Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update3j:*:*:*:*:*:* Versions 6.7 update3j Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update3l:*:*:*:*:*:* Versions 6.7 update3l Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update3m:*:*:*:*:*:* Versions 6.7 update3m Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update3n:*:*:*:*:*:* Versions 6.7 update3n Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update3o:*:*:*:*:*:* Versions 6.7 update3o Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update3p:*:*:*:*:*:* Versions 6.7 update3p Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update3q:*:*:*:*:*:* Versions 6.7 update3q Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:* Versions 7.0 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:* Versions 7.0 a Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:* Versions 7.0 b Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:* Versions 7.0 c Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:* Versions 7.0 d Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:* Versions 7.0 update1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:* Versions 7.0 update1a Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update1c:*:*:*:*:*:* Versions 7.0 update1c Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update1d:*:*:*:*:*:* Versions 7.0 update1d Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update2:*:*:*:*:*:* Versions 7.0 update2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update2a:*:*:*:*:*:* Versions 7.0 update2a Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update2b:*:*:*:*:*:* Versions 7.0 update2b Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update2c:*:*:*:*:*:* Versions 7.0 update2c Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update2d:*:*:*:*:*:* Versions 7.0 update2d Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3:*:*:*:*:*:* Versions 7.0 update3 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3a:*:*:*:*:*:* Versions 7.0 update3a Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3c:*:*:*:*:*:* Versions 7.0 update3c Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3d:*:*:*:*:*:* Versions 7.0 update3d Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3e:*:*:*:*:*:* Versions 7.0 update3e Vulnerable ·VMware

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-22982
  2. 2026-10-03 Alias added: GHSA-cvx4-254w-9ppg

References

Advisory 1

  • TI-2024-26040 Privilege escalation in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26039 Heap-overflow in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-24610 Out-of-bounds write in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-07131 Code injection in VMware Workspace ONE Access and Identity Manager KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05049 Path traversal in VMware vCenter Server, VMware Cloud Foundation KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05029 Improper input validation in VMware vCenter Server and VMware Cloud Foundation KEVCVSS 3.1CRITICAL 9.8
See all 134 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences