3a. VMware Cloud Foundation update addresses a remote code execution vulnerability via XStream (CVE-2021-39144)
VMware Cloud Foundation contains a remote code execution vulnerability via XStream open source library. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
3b. VMware Cloud Foundation update addresses an XML External Entity (XXE) vulnerability (CVE-2022-31678)
VMware Cloud Foundation contains an XML External Entity (XXE) vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.3.
CPE | Name | Operator | Version |
---|---|---|---|
vmware cloud foundation (nsx-v) | eq | 3.11 | |
vmware cloud foundation (nsx-v) | eq | 3.11 |
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39144
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31678
docs.vmware.com/en/VMware-Cloud-Foundation/3.11/rn/vmware-cloud-foundation-311-release-notes/index.html
www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N