Intrusion PreventionVMware.vCenter.Server.SsoOverRestVerifierUtil.DoS
Description
This indicates an attack attempt to exploit a Denial of Service Vulnerability in VMWare vCenter Server.
This vulnerability is due to improper validation of the value stored in the TokenParts header in HTTP GET requests to vulnerable endpoints. A remote, unauthenticated attacker could exploit this vulnerability by sending a crafted request with a large value in the TokenParts header to the vulnerable endpoints. Successfully exploiting this vulnerability could result in denial of service conditions on the target server.
Affected Products
VMWare Cloud Foundation 3.x
VMWare Cloud Foundation 4.x
VMWare vCenter Server 6.5 prior to update U3u
VMWare vCenter Server 6.7 prior to update U3s
VMWare vCenter Server 7.0 prior to update U3i
Impact
Denial of Service: Remote attackers can crash vulnerable systems.
Recommended Actions
Apply the most recent upgrade or patch from the vendor.
https://www.vmware.com/security/advisories/VMSA-2022-0030.html
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
| ID | 52508 |
| Created | Jan 10, 2023 |
| Updated | Jan 28, 2023 |
| Risk |
|
| CVE ID | CVE-2022-31698 |
| Exploit Prediction Score | 0.08% |
| Default Action | drop |
| Active | |
| Affected OS | Windows, Linux |
| Affected App | Other |