Medium severity · published Aug 9, 2022
CVE-2022-22983
VMware Workstation (16.x prior to 16.2.4) contains an unprotected storage of credentials vulnerability
5.9
CVSS
0.3%
EPSS
No
On KEV
Description
VMware Workstation (16.x prior to 16.2.4) contains an unprotected storage of credentials vulnerability. A malicious actor with local user privileges to the victim machine may exploit this vulnerability leading to the disclosure of user passwords of the remote server connected through VMware Workstation.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VW
VMware Workstation ·
VMware Workstation (16.x prior to 16.2.4) · source: vendor
WO
Workstation · Vmware
16.0.0 before 16.2.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-22983
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-22983
Patch
https://www.vmware.com/security/advisories/VMSA-2022-0023.html
More from VMware Workstation
6.0
CVE-2025-22226
VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability