RCE in VMware Bosh Editor
CVE-2022-31691
Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor and Cloudfoundry Manifest YML Support version 1.39.0 and below all use Snakeyaml library for YAML editing support. This library allows for some special syntax in the YAML that under certain circumstances allows for potentially harmful remote code execution by the attacker.
Vulnerability class: RCE (Remote Code Execution)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.026 (85.0th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 85th percentile — 85.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.025 · newest: 0.026 · change: +0.001
Affected products
- VMware Bosh Editor
- VMware Cloudfoundry Manifest Yml Support
- VMware Concourse Ci Pipeline Editor
- VMware Spring Boot Tools
- VMware Spring Tools
- Spring By VMware — versions Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor and Cloudfoundry Manifest YML Support version 1.39.0 and below all use Snakeyaml library for YAML editing support.
Weakness classification (CWE)
Public proof-of-concept exploits
References
- tanzu.vmware.com/security/cve-2022-31691 (Vendor Advisory)
Frequently asked questions
- What is CVE-2022-31691?
- CVE-2022-31691 is a critical-severity vulnerability in VMware Bosh Editor, classified under Code Injection. CVSS score: 9.8/10. Published 2022-11-04.
- How severe is CVE-2022-31691?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2022-31691 known to be exploited?
- 8 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.