This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] VMware fixes 3 vulnerabilities in its products

VMware fixes 3 vulnerabilities in its products. Products and their fixes: VMware Aria Automation - 8.17.0 [1] VMware Cloud Director - 4.7.2 [2] Spring Cloud Function - 4.0.8, 4.1.2 [3]

VMware Aria - SQL injection (CVE-2024-22280)
CVSS 8.5 (High)

Allows an authenticated remote attacker to submit specially crafted SQL queries and perform unauthorized read and write operations in the database [1].

The vulnerability is present in product:

  • VMware Aria Automation; >=8.0.0, <8.17.0

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

More information:

The vulnerability was publicly disclosed 11. 7. 2024.

VMware Cloud Director - HTML injection (CVE-2024-22277)
CVSS 6.4 (Medium)

Allows an authenticated remote attacker to create malicious HTML tags that are executed within replication tasks [2].

The vulnerability is present in product:

  • VMware Cloud Director; >=4.0.0, <4.7.2

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

More information:

The vulnerability was publicly disclosed 4. 7. 2024.

VMware Spring - DoS (CVE-2024-22271)
CVSS 8.2 (High)

Allows an unauthenticated remote attacker to carry out a DoS attack when attempting to compose functions with non-existent functions [3].

The vulnerability is present in product:

  • Spring Cloud Function; >=4.0.0, <4.0.8; >=4.1.0, <4.1.2

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

More information:

The vulnerability was publicly disclosed 10. 7. 2024.

By CESNET, z.s.p.o. Michaela Jarošová on 15. 7. 2024.

CESNET, z.s.p.o. Logo