CVE-2024-22272 - Vulnerability Details - OpenCVE

VMware Cloud Director contains an Improper Privilege Management vulnerability. An authenticated tenant administrator for a given organization within VMware Cloud Director may be able to accidentally disable their organization leading to a Denial of Service for active sessions within their own organization's scope.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24371

History

Mon, 02 Dec 2024 18:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-862
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: vmware

Published: 2024-06-27T20:22:17.660Z

Updated: 2024-12-02T17:41:22.527Z

Reserved: 2024-01-08T18:43:18.957Z

Link: CVE-2024-22272

Vulnrichment

Updated: 2024-08-01T22:43:34.148Z

NVD

Status : Awaiting Analysis

Published: 2024-06-27T21:15:13.670

Modified: 2024-12-02T18:15:09.290

Link: CVE-2024-22272

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-22272", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2024-01-08T18:43:18.957Z", "datePublished": "2024-06-27T20:22:17.660Z", "dateUpdated": "2024-12-02T17:41:22.527Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "VMware Cloud Director", "vendor": "N/A", "versions": [{"status": "affected", "version": "VMware Cloud Director 10.5.x, VMware Cloud Director 10.4.x"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\nVMware Cloud Director contains an Improper Privilege Management vulnerability. \n\n\nAn authenticated tenant administrator for a\n given organization within VMware Cloud Director may be able to \naccidentally disable their organization leading to a Denial of Service \nfor active sessions within their own organization's scope.\n\n"}], "value": "VMware Cloud Director contains an Improper Privilege Management vulnerability. \n\n\nAn authenticated tenant administrator for a\n given organization within VMware Cloud Director may be able to \naccidentally disable their organization leading to a Denial of Service \nfor active sessions within their own organization's scope."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"description": "Improper Privilege Management", "lang": "en"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2024-06-27T20:22:17.660Z"}, "references": [{"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24371"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-862", "lang": "en", "description": "CWE-862 Missing Authorization"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-02T18:58:12.318931Z", "id": "CVE-2024-22272", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-02T17:41:22.527Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:43:34.148Z"}, "title": "CVE Program Container", "references": [{"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24371", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24371", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:43:34.148Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-22272", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-02T18:58:12.318931Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-02T18:58:31.272Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "N/A", "product": "VMware Cloud Director", "versions": [{"status": "affected", "version": "VMware Cloud Director 10.5.x, VMware Cloud Director 10.4.x"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24371"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "VMware Cloud Director contains an Improper Privilege Management vulnerability. \n\n\nAn authenticated tenant administrator for a\n given organization within VMware Cloud Director may be able to \naccidentally disable their organization leading to a Denial of Service \nfor active sessions within their own organization's scope.", "supportingMedia": [{"type": "text/html", "value": "\nVMware Cloud Director contains an Improper Privilege Management vulnerability. \n\n\nAn authenticated tenant administrator for a\n given organization within VMware Cloud Director may be able to \naccidentally disable their organization leading to a Denial of Service \nfor active sessions within their own organization's scope.\n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Privilege Management"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2024-06-27T20:22:17.660Z"}}}, "cveMetadata": {"cveId": "CVE-2024-22272", "state": "PUBLISHED", "dateUpdated": "2024-12-02T17:41:22.527Z", "dateReserved": "2024-01-08T18:43:18.957Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2024-06-27T20:22:17.660Z", "assignerShortName": "vmware"}, "dataVersion": "5.1"}