This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] VMware fixes 3 vulnerabilities in vCenter Server and Cloud Foundation products

VMware vCenter Server versions 7.0 U3r, 8.0 U1e and 8.0 U2d fix 3 vulnerabilities [1]. For VMware Cloud Foundation, follow KB88287 [2].

VMware - RCE (CVE-2024-37079, CVE-2024-37080)
CVSS 9.8 (Critical)

An unauthenticated remote attacker can, due to a buffer overflow in the DCE/RPC protocol implementation, achieve remote code execution by sending a specially crafted network packet [1].

The vulnerability is present in products:

  • VMware vCenter Server; >=7.0, <=8.0
  • VMware Cloud Foundation; >=4.0, <=5.0

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 18. 6. 2024.

VMware - privilege escalation (CVE-2024-37081)
CVSS 7.8 (High)

An authenticated local attacker can, due to a sudo misconfiguration, elevate their privileges to root on the vCenter Server Appliance [1].

The vulnerability is present in products:

  • VMware vCenter Server; >=7.0, <=8.0
  • VMware Cloud Foundation; >=4.0, <=5.0

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 18. 6. 2024.

By CESNET, z.s.p.o. Michaela Jarošová on 18. 6. 2024.

CESNET, z.s.p.o. Logo