Skip to content
OpenAdvisories
Medium WID-SEC-2024-3555 5 CVEs

VMware Aria Operations: Mehrere Schwachstellen

Published Nov 26, 2024 · Updated Dec 10, 2024 · Revision 2 · de-DE

Vendor: Google Vendor: VMware Product: Aria Operations Product: Cloud Platform Platform: Windows

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen in VMware Aria Operations ausnutzen, um seine Privilegien zu erhöhen und einen Cross-Site-Scripting-Angriff durchzuführen.

Product

VMware Aria Operations bietet eine einheitliche Plattform für das IT-Betriebsmanagement in Private-, Hybrid- und Multi-Cloud-Umgebungen.

Vulnerabilities 5

  • High 7.8
    CVE-2024-38830

    Local privilege escalation vulnerability

    VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges may trigger this vulnerability to escalate privileges to root user on the appliance running VMware Aria Operations.

    VMware VMware Aria Operations
  • High 7.8
    CVE-2024-38831

    Local privilege escalation vulnerability (CVE-2024-38831)

    VMware Aria Operations contains a local privilege escalation vulnerability.  A malicious actor with local administrative privileges can insert malicious commands into the properties file to escalate privileges to  a root user on the appliance running VMware A…

    VMware VMware Aria Operations
  • High 7.1
    CVE-2024-38832

    Stored cross-site scripting vulnerability (CVE-2024-38832)

    VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to views may be able to inject malicious script leading to stored cross-site scripting in the product VMware Aria Operations.

    VMware VMware Aria Operations
  • Medium 6.8
    CVE-2024-38833

    Stored cross-site scripting vulnerability (CVE-2024-38833)

    VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to email templates might inject malicious script leading to stored cross-site scripting in the product VMware Aria Operations.

    VMware VMware Aria Operations
  • Medium 6.5
    CVE-2024-38834

    Stored cross-site scripting vulnerability (CVE-2024-38834)

    VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to cloud provider might be able to inject malicious script leading to stored cross-site scripting in the product VMware Aria Operations.

    VMware VMware Aria Operations

Revision history

  1. #2

    Neue Updates von Google aufgenommen

  2. #1

    Initiale Fassung

References