CVE-2022-31691

CRITICAL

9.8

Descricao

Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor and Cloudfoundry Manifest YML Support version 1.39.0 and below all use Snakeyaml library for YAML editing support. This library allows for some special syntax in the YAML that under certain circumstances allows for potentially harmful remote code execution by the attacker.

Detalhes CVE

Pontuacao CVSS v3.19.8

SeveridadeCRITICAL

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado11/4/2022

Ultima modificacao5/2/2025

Fontenvd

Avistamentos honeypot0

Produtos afetados

vmware:bosh_editorvmware:cloudfoundry_manifest_yml_supportvmware:concourse_ci_pipeline_editorvmware:spring_boot_toolsvmware:spring_tools

Fraquezas (CWE)

CWE-94

Referencias

https://tanzu.vmware.com/security/cve-2022-31691(security@vmware.com)

https://tanzu.vmware.com/security/cve-2022-31691(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.