RCE in VMware Bosh Editor
CVE-2022-31691
Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor and Cloudfoundry Manifest YML Support version 1.39.0 and below all use Snakeyaml library for YAML editing support. This library allows for some special syntax in the YAML that under certain circumstances allows for potentially harmful remote code execution by the attacker.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.024 (82.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Vmware Bosh_editor
- Vmware Cloudfoundry_manifest_yml_support
- Vmware Concourse_ci_pipeline_editor
- Vmware Spring_boot_tools
- Vmware Spring_tools
- N/a Spring By Vmware — versions Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor and Cloudfoundry Manifest YML Support version 1.39.0 and below all use Snakeyaml library for YAML editing support.
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@vmware.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2022-31691?
- CVE-2022-31691 is a critical-severity vulnerability in VMware Bosh Editor, classified under Code Injection. CVSS score: 9.8/10. Published 2022-11-04.
- How severe is CVE-2022-31691?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2022-31691 known to be exploited?
- 8 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.