Cyber Resilience

CVE-2022-31674

Medium

Published: 10 August 2022

Published
10 August 2022
Modified
27 August 2025
KEV Added
Patch
CVSS Score v3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0027 50.7th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-31674 is a medium-severity Insertion of Sensitive Information into Log File (CWE-532) vulnerability in Vmware Vrealize Operations. Its CVSS base score is 4.3 (Medium).

Operationally, ranked in the top 49.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

VMware vRealize Operations contains an information disclosure vulnerability. A low-privileged malicious actor with network access can access log files that lead to information disclosure.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

vmware
vrealize operations
8.0.0 — 8.6.4

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-200 CWE-532

Monitoring directly detects unauthorized disclosure of sensitive information, enabling response to exposures.

addresses: CWE-200 CWE-532

Coordinating audit logging across organizational boundaries reduces the risk of sensitive audit data being exposed to unauthorized actors during transmission.

addresses: CWE-200 CWE-532

A data action map identifies locations where sensitive information may be exposed to unauthorized actors during processing or transfer.

addresses: CWE-200 CWE-532

The control's identification, isolation, alerting, and eradication steps directly limit the impact and exploitation window of unauthorized sensitive information exposure.

addresses: CWE-200 CWE-532

Requiring organization-defined processing conditions on specific PII categories directly reduces the chance that personal data will be exposed to unauthorized actors.

addresses: CWE-200 CWE-532

The assessment process surfaces design decisions that could expose sensitive (including PII) data to unauthorized actors, prompting controls that reduce such exposure.

addresses: CWE-200 CWE-532

Directly prevents exposure of critical organizational information by applying OPSEC processes across the SDLC.

addresses: CWE-200 CWE-532

Filtering output to only permitted content stops unintended disclosure of sensitive information to unauthorized actors.

References