CVE-2022-31697: VMware Cloud Foundation

Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days.

The vCenter Server contains an information disclosure vulnerability due to the logging of credentials in plaintext. A malicious actor with access to a workstation that invoked a vCenter Server Appliance ISO operation (Install/Upgrade/Migrate/Restore) can access plaintext passwords used during that operation.

Affected products

• VMware Cloud Foundation: from 3.0
• VMware vCenter Server: version 6.5 only; version 6.7 only; version 7.0 only

Published 2022-12-13. Last modified 2026-06-17.