Report feedback

An authenticated remote attacker can obtain the privileges of a group role other than the one previously assigned to them [1].

The vulnerability is present in products:

• NSX; >=4.0, <4.2.1
• Cloud Foundation (NSX); >=5.0, <5.2.1

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L

More information:

• CVE-2024-38818 at cve.org, NVD
• CWE-269: Improper Privilege Management at cwe.mitre.org

The vulnerability was publicly disclosed 9. 10. 2024.

An authenticated local attacker with access to the NSX Edge CLI terminal can craft malicious payloads and execute arbitrary commands in the operating system as root [1].

The vulnerability is present in products:

• NSX;>=4.0, <4.2.1
• NSX-T; >=3.0, <3.2.4.1
• Cloud Foundation (NSX);
• Cloud Foundation (NSX-T);

CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

• CVE-2024-38817 at cve.org, NVD
• CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 9. 10. 2024.

An authenticated remote attacker can craft a malicious URL and redirect the victim to a domain controlled by the attacker, which may lead to the disclosure of sensitive information [1].

The vulnerability is present in products:

• NSX; >=4.0, <4.2.1
• Cloud Foundation (NSX); >=5.0, <5.2.1

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

More information:

• CVE-2024-38815 at cve.org, NVD
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 9. 10. 2024.