CVE-2022-23239 in Active IQ Unified Manager for VMware
Summary
by MITRE • 03/01/2023
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.11P1 are susceptible to a vulnerability which allows administrative users to perform a Stored Cross-Site Scripting (XSS) attack.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/30/2026
The vulnerability identified as CVE-2022-23239 affects Active IQ Unified Manager versions prior to 9.11P1 across VMware vSphere, Linux, and Microsoft Windows platforms. This represents a critical security flaw that undermines the integrity of administrative user sessions within the unified management interface. The vulnerability specifically targets the input validation mechanisms of the application's web interface, creating an avenue for malicious actors to inject persistent malicious scripts into the system's data storage.
The technical flaw manifests as a stored cross-site scripting vulnerability that occurs when administrative users interact with the application's web-based management console. When legitimate administrative users view content that contains malicious script payloads, these scripts execute within their browser context with the privileges of the authenticated user. This type of vulnerability falls under CWE-079 - Improper Neutralization of Input During Web Page Generation, which is classified as a common weakness in web application security frameworks. The vulnerability enables attackers to establish persistent malicious code execution that remains active even after the initial injection point.
The operational impact of this vulnerability is severe as it allows attackers to perform administrative actions on behalf of legitimate users with elevated privileges. An attacker who successfully exploits this vulnerability can manipulate the management interface to perform unauthorized operations, potentially leading to complete system compromise. The stored nature of the XSS attack means that the malicious code persists in the application's database or storage mechanisms, making it particularly dangerous as it affects multiple users who view the compromised content. This vulnerability directly aligns with ATT&CK technique T1059.001 - Command and Scripting Interpreter: PowerShell, as it enables attackers to establish persistent command execution capabilities through web-based interfaces.
The vulnerability affects the core management functionality of Active IQ Unified Manager, which serves as a centralized monitoring and management platform for storage environments. Administrative users who access the web console to perform routine management tasks become potential targets for exploitation. The attack surface is particularly concerning as it targets the most privileged users within the system, potentially allowing attackers to access sensitive configuration data, modify storage policies, or even manipulate the underlying storage infrastructure. Organizations utilizing these older versions of the software face significant risk of unauthorized access and potential data compromise through this persistent XSS vulnerability.
Mitigation strategies should prioritize immediate patching to versions 9.11P1 or later, which contain the necessary input validation fixes to prevent malicious script injection. Organizations should implement additional security measures including web application firewalls, input sanitization at the application layer, and regular security assessments of the management interface. Network segmentation and least privilege access controls should be enforced to limit the potential impact of successful exploitation. The vulnerability demonstrates the importance of maintaining up-to-date software versions and implementing comprehensive security monitoring to detect potential exploitation attempts. Security teams should also conduct regular penetration testing and code reviews to identify similar weaknesses in other web applications within their environment.