Read the docs
TI-2022-13615 Aliases CVE-2022-31697GHSA-j724-gwg9-qjvw

Cleartext storage of sensitive information in VMware vCenter Server, VMware Cloud…

Priority LOW 24CWE-312Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-312.

Summary

The vCenter Server contains an information disclosure vulnerability due to the logging of credentials in plaintext. A malicious actor with access to a workstation that invoked a vCenter Server Appliance ISO operation (Install/Upgrade/Migrate/Restore) can access plaintext passwords used during that operation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00134 2nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—VMware vCenter Server, VMware Cloud FoundationVMware (7.0 prior to 7.0 U3i, 6.7 prior to 6.7.0 U3s, 6.5 prior to 6.5 U3u), VMware Cloud Foundation (4.x, 3.x)—No fix listedCNA
  • VMware vCenter Server, VMware Cloud Foundation Vendor— Affected VMware (7.0 prior to 7.0 U3i, 6.7 prior to 6.7.0 U3s, 6.5 prior to 6.5 U3u), VMware Cloud Foundation (4.x, 3.x) Fixed in — No fix listed CNA

CPE configurations NVD · 70

CPEVersionsRoleVendor
cpe:2.3:a:vmware:vcenter_server:6.5:-:*:*:*:*:*:*6.5VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:a:*:*:*:*:*:*6.5 aVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:b:*:*:*:*:*:*6.5 bVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:c:*:*:*:*:*:*6.5 cVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:d:*:*:*:*:*:*6.5 dVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update1:*:*:*:*:*:*6.5 update1VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update1b:*:*:*:*:*:*6.5 update1bVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update1d:*:*:*:*:*:*6.5 update1dVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update1e:*:*:*:*:*:*6.5 update1eVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update1g:*:*:*:*:*:*6.5 update1gVulnerableVMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:-:*:*:*:*:*:* Versions 6.5 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:a:*:*:*:*:*:* Versions 6.5 a Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:b:*:*:*:*:*:* Versions 6.5 b Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:c:*:*:*:*:*:* Versions 6.5 c Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:d:*:*:*:*:*:* Versions 6.5 d Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update1:*:*:*:*:*:* Versions 6.5 update1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update1b:*:*:*:*:*:* Versions 6.5 update1b Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update1d:*:*:*:*:*:* Versions 6.5 update1d Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update1e:*:*:*:*:*:* Versions 6.5 update1e Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update1g:*:*:*:*:*:* Versions 6.5 update1g Vulnerable ·VMware
Show 60 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:vmware:vcenter_server:6.5:update2:*:*:*:*:*:*6.5 update2VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update2b:*:*:*:*:*:*6.5 update2bVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update2c:*:*:*:*:*:*6.5 update2cVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update2d:*:*:*:*:*:*6.5 update2dVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update2g:*:*:*:*:*:*6.5 update2gVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update3:*:*:*:*:*:*6.5 update3VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update3d:*:*:*:*:*:*6.5 update3dVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update3f:*:*:*:*:*:*6.5 update3fVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update3k:*:*:*:*:*:*6.5 update3kVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update3n:*:*:*:*:*:*6.5 update3nVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update3p:*:*:*:*:*:*6.5 update3pVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update3q:*:*:*:*:*:*6.5 update3qVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update3r:*:*:*:*:*:*6.5 update3rVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update3s:*:*:*:*:*:*6.5 update3sVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update3t:*:*:*:*:*:*6.5 update3tVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:-:*:*:*:*:*:*6.7VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:a:*:*:*:*:*:*6.7 aVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:b:*:*:*:*:*:*6.7 bVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:c:*:*:*:*:*:*6.7 cVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:d:*:*:*:*:*:*6.7 dVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update1:*:*:*:*:*:*6.7 update1VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update1b:*:*:*:*:*:*6.7 update1bVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update2:*:*:*:*:*:*6.7 update2VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update2a:*:*:*:*:*:*6.7 update2aVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update2c:*:*:*:*:*:*6.7 update2cVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update3:*:*:*:*:*:*6.7 update3VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update3a:*:*:*:*:*:*6.7 update3aVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update3b:*:*:*:*:*:*6.7 update3bVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update3f:*:*:*:*:*:*6.7 update3fVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update3g:*:*:*:*:*:*6.7 update3gVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update3j:*:*:*:*:*:*6.7 update3jVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update3l:*:*:*:*:*:*6.7 update3lVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update3m:*:*:*:*:*:*6.7 update3mVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update3n:*:*:*:*:*:*6.7 update3nVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update3o:*:*:*:*:*:*6.7 update3oVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update3p:*:*:*:*:*:*6.7 update3pVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update3q:*:*:*:*:*:*6.7 update3qVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update3r:*:*:*:*:*:*6.7 update3rVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:*7.0VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:*7.0 aVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:*7.0 bVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:*7.0 cVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:*7.0 dVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:*7.0 update1VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:*7.0 update1aVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update1c:*:*:*:*:*:*7.0 update1cVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update2:*:*:*:*:*:*7.0 update2VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update2a:*:*:*:*:*:*7.0 update2aVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update2b:*:*:*:*:*:*7.0 update2bVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update2c:*:*:*:*:*:*7.0 update2cVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update2d:*:*:*:*:*:*7.0 update2dVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3:*:*:*:*:*:*7.0 update3VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3a:*:*:*:*:*:*7.0 update3aVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3c:*:*:*:*:*:*7.0 update3cVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3d:*:*:*:*:*:*7.0 update3dVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3e:*:*:*:*:*:*7.0 update3eVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3f:*:*:*:*:*:*7.0 update3fVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3g:*:*:*:*:*:*7.0 update3gVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3h:*:*:*:*:*:*7.0 update3hVulnerableVMware
cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*3.0VulnerableVMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update2:*:*:*:*:*:* Versions 6.5 update2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update2b:*:*:*:*:*:* Versions 6.5 update2b Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update2c:*:*:*:*:*:* Versions 6.5 update2c Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update2d:*:*:*:*:*:* Versions 6.5 update2d Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update2g:*:*:*:*:*:* Versions 6.5 update2g Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update3:*:*:*:*:*:* Versions 6.5 update3 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update3d:*:*:*:*:*:* Versions 6.5 update3d Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update3f:*:*:*:*:*:* Versions 6.5 update3f Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update3k:*:*:*:*:*:* Versions 6.5 update3k Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update3n:*:*:*:*:*:* Versions 6.5 update3n Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update3p:*:*:*:*:*:* Versions 6.5 update3p Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update3q:*:*:*:*:*:* Versions 6.5 update3q Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update3r:*:*:*:*:*:* Versions 6.5 update3r Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update3s:*:*:*:*:*:* Versions 6.5 update3s Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update3t:*:*:*:*:*:* Versions 6.5 update3t Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:-:*:*:*:*:*:* Versions 6.7 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:a:*:*:*:*:*:* Versions 6.7 a Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:b:*:*:*:*:*:* Versions 6.7 b Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:c:*:*:*:*:*:* Versions 6.7 c Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:d:*:*:*:*:*:* Versions 6.7 d Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update1:*:*:*:*:*:* Versions 6.7 update1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update1b:*:*:*:*:*:* Versions 6.7 update1b Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update2:*:*:*:*:*:* Versions 6.7 update2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update2a:*:*:*:*:*:* Versions 6.7 update2a Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update2c:*:*:*:*:*:* Versions 6.7 update2c Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update3:*:*:*:*:*:* Versions 6.7 update3 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update3a:*:*:*:*:*:* Versions 6.7 update3a Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update3b:*:*:*:*:*:* Versions 6.7 update3b Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update3f:*:*:*:*:*:* Versions 6.7 update3f Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update3g:*:*:*:*:*:* Versions 6.7 update3g Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update3j:*:*:*:*:*:* Versions 6.7 update3j Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update3l:*:*:*:*:*:* Versions 6.7 update3l Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update3m:*:*:*:*:*:* Versions 6.7 update3m Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update3n:*:*:*:*:*:* Versions 6.7 update3n Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update3o:*:*:*:*:*:* Versions 6.7 update3o Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update3p:*:*:*:*:*:* Versions 6.7 update3p Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update3q:*:*:*:*:*:* Versions 6.7 update3q Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update3r:*:*:*:*:*:* Versions 6.7 update3r Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:* Versions 7.0 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:* Versions 7.0 a Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:* Versions 7.0 b Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:* Versions 7.0 c Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:* Versions 7.0 d Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:* Versions 7.0 update1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:* Versions 7.0 update1a Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update1c:*:*:*:*:*:* Versions 7.0 update1c Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update2:*:*:*:*:*:* Versions 7.0 update2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update2a:*:*:*:*:*:* Versions 7.0 update2a Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update2b:*:*:*:*:*:* Versions 7.0 update2b Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update2c:*:*:*:*:*:* Versions 7.0 update2c Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update2d:*:*:*:*:*:* Versions 7.0 update2d Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3:*:*:*:*:*:* Versions 7.0 update3 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3a:*:*:*:*:*:* Versions 7.0 update3a Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3c:*:*:*:*:*:* Versions 7.0 update3c Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3d:*:*:*:*:*:* Versions 7.0 update3d Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3e:*:*:*:*:*:* Versions 7.0 update3e Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3f:*:*:*:*:*:* Versions 7.0 update3f Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3g:*:*:*:*:*:* Versions 7.0 update3g Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3h:*:*:*:*:*:* Versions 7.0 update3h Vulnerable ·VMware
  • cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·VMware

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31697
  2. 2026-10-03 Alias added: GHSA-j724-gwg9-qjvw

References

Advisory 1

  • TI-2024-26040 Privilege escalation in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26039 Heap-overflow in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-24610 Out-of-bounds write in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-07131 Code injection in VMware Workspace ONE Access and Identity Manager KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05049 Path traversal in VMware vCenter Server, VMware Cloud Foundation KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05029 Improper input validation in VMware vCenter Server and VMware Cloud Foundation KEVCVSS 3.1CRITICAL 9.8
See all 134 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences