CVE-2022-22951 - VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains an OS command injection vulnerability

Back Back to CVE browser

CRITICAL

VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains an OS command injection vulnerability

Published Mar 23, 2022

9.1

CRITICAL

CVSS 3.1

EPSS 20.32%

Description

VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains an OS command injection vulnerability. An authenticated, high privileged malicious actor with network access to the VMware App Control administration interface may be able to execute commands on the server due to improper input validation leading to remote code execution.

Affected products

Vendor n/a Product VMware Carbon Black App Control (AppC) Default
n/a
- Version
  VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2)
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

VMware Carbon Black App Control (AppC)

n/a

Version	Status	Constraints
VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2)	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-28074
Advisory
https://www.vmware.com/security/advisories/VMSA-2022-0008.html
x_refsource_MISCPatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-28074		Advisory
https://www.vmware.com/security/advisories/VMSA-2022-0008.html		x_refsource_MISCPatchVendor Advisory