How To Fix CVE-2022-22951(2)- Critical Vulnerabilities In VMware Carbon Black App Control Server

VMware issued an advisory against a couple of critical vulnerabilities in the VMware Carbon Black App Control server. The vulnerabilities tracked as CVE-2022-22951 and CVE-2022-22952 have a CVSS score of 9.1 and are considered critical. Attackers can leverage these vulnerabilities to carry out remote code execution on the vulnerable versions of VMware Carbon Black App Control Server. There is a need to fix these vulnerabilities. This article will show you how to fix CVE-2022-22951(2), Critical Vulnerabilities in VMware Carbon Black App Control Server.

VMware Carbon Black App Control

VMware Carbon Black App Control is an application that is designed to monitor and protect various applications, harden systems against unwanted change, simplify the compliance process, and provide protection for corporate systems by letting to run only trusted and approved software on an organization’s critical systems. Some of its main features include:

List Of Vulnerabilities In VMware Carbon Black App Control Server

Summary Of CVE-2022-22951:

The flaw is an OS command injection vulnerability that allows an authenticated, high privileged user to execute commands on the server due to improper input validation. The user should have access to the App Control administration interface over the network to perform remote code execution. The vulnerability is considered critical since it has a CVSS score of 9.1 out of 10 according to the Common Vulnerability Scoring System.

Summary of CVE-2022-22952:

The flaw is a file upload vulnerability that allows a user with administrative access to the VMware App Control administration interface to execute code on the Windows machine on which the App Control is hosted. This flaw can be abused just by uploading a specially crafted file on the vulnerable version of the App Control server to perform remote code execution. The vulnerability is considered critical since it has a CVSS score of 9.1 out of 10 according to the Common Vulnerability Scoring System.

How To Fix CVE-2022-22951(2)- Critical Vulnerabilities In VMware Carbon Black App Control Server?

The advisory says both vulnerabilities affect VMware Carbon Black App Control Server versions 8.5.x, 8.6.x, 8.7.x, and 8.8.x. If you are running a CB App Control server with any of these versions, we highly recommend upgrading to the patched versions, 8.5.14, 8.6.6, 8.7.4, and 8.8.2. 

Note:

How To Upgrade VMware Carbon Black App Control Serve?

Please refer to this VMware Carbon Black App Control

for more details.

We hope this post would help you know How to Fix CVE-2022-22951(2)- Critical Vulnerabilities in VMware Carbon Black App Control Server. Please share this post and help to secure the digital world. Visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, & Medium and subscribe to receive updates like this.