This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] VMware Aria Operations fixes 5 vulnerabilities
VMware Aria Operations version 8.18.2 fixes 5 vulnerabilities [1].
Allows an authenticated local attacker with administrator privileges to escalate privileges to root [1].
The vulnerability is present in products:
- VMware Aria Operations; >=8, <8.18.2;
- VMware Cloud Foundation; >=5, <=5.2.1;
- VMware Cloud Foundation; >=4, <=4.5.2;
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-38830 at cve.org, NVD
- CWE-269: Improper Privilege Management at cwe.mitre.org
The vulnerability was publicly disclosed 26. 11. 2024.
Allows an authenticated local attacker with administrator privileges to escalate privileges to root by inserting malicious commands into the "properties" file [1].
The vulnerability is present in products:
- VMware Aria Operations; >=8, <8.18.2;
- VMware Cloud Foundation; >=5, <=5.2.1;
- VMware Cloud Foundation; >=4, <=4.5.2;
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-38831 at cve.org, NVD
- CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 26. 11. 2024.
Allows an authenticated remote attacker with permission to edit views to carry out a stored XSS attack [1].
The vulnerability is present in products:
- VMware Aria Operations; >=8, <8.18.2;
- VMware Cloud Foundation; >=5, <=5.2.1;
- VMware Cloud Foundation; >=4, <=4.5.2;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
More information:
- CVE-2024-38832 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 26. 11. 2024.
Allows an authenticated remote attacker with permission to edit e-mail templates to carry out a stored XSS attack [1].
The vulnerability is present in products:
- VMware Aria Operations; >=8, <8.18.2;
- VMware Cloud Foundation; >=5, <=5.2.1;
- VMware Cloud Foundation; >=4, <=4.5.2;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
More information:
- CVE-2024-38833 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 26. 11. 2024.
Allows an authenticated remote attacker with permission to edit the cloud provider to carry out an XSS attack [1].
The vulnerability is present in products:
- VMware Aria Operations; >=8, <8.18.2;
- VMware Cloud Foundation; >=5, <=5.2.1;
- VMware Cloud Foundation; >=4, <=4.5.2;
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:L
More information:
- CVE-2024-38834 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 26. 11. 2024.
By CESNET, z.s.p.o. Michaela Ručková on 2. 12. 2024.