CVE-2024-38814 HIGH

CVE-2024-38814

Vendor N/A
Product VMware HCX
Weakness CWE-89 · SQLi
Published October 16, 2024
Last update October 16, 2024
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

An authenticated SQL injection vulnerability in VMware HCX was privately reported to VMware. A malicious authenticated user with non-administrator privileges may be able to enter specially crafted SQL queries and perform unauthorized remote code execution on the HCX manager.  Updates are available to remediate this vulnerability in affected VMware products.

Key dates

02Disclosure timeline

October 16, 2024 CVE published
October 16, 2024 Record updated