CVE-2024-22277 - OpenCVE

VMware Cloud Director Availability contains an HTML injection vulnerability. A malicious actor with network access to VMware Cloud Director Availability can craft malicious HTML tags to execute within replication tasks.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Vmware	Cloud Director

Configuration 1 [-]

cpe:2.3:a:vmware:cloud_director:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24557

History

Wed, 21 Aug 2024 16:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Vmware Vmware cloud Director
Weaknesses		CWE-79
CPEs		cpe:2.3:a:vmware:cloud_director::::::::
Vendors & Products		Vmware Vmware cloud Director

MITRE

Status: PUBLISHED

Assigner: vmware

Published: 2024-07-04T13:21:17.247Z

Updated: 2024-08-01T22:43:34.111Z

Reserved: 2024-01-08T18:43:18.959Z

Link: CVE-2024-22277

Vulnrichment

Updated: 2024-08-01T22:43:34.111Z

NVD

Status : Analyzed

Published: 2024-07-04T14:15:01.990

Modified: 2024-08-21T16:12:46.790

Link: CVE-2024-22277

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-22277", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2024-01-08T18:43:18.959Z", "datePublished": "2024-07-04T13:21:17.247Z", "dateUpdated": "2024-08-01T22:43:34.111Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "VMware Cloud Director Availability", "vendor": "N/A", "versions": [{"status": "affected", "version": "VMware Cloud Director Availability 4.x"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\nVMware Cloud Director Availability contains an HTML injection vulnerability. \nA\n malicious actor with network access to VMware Cloud Director \nAvailability can craft malicious HTML tags to execute within replication\n tasks. \n\n<br>"}], "value": "VMware Cloud Director Availability contains an HTML injection vulnerability. \nA\n malicious actor with network access to VMware Cloud Director \nAvailability can craft malicious HTML tags to execute within replication\n tasks."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"description": "HTML Injection", "lang": "en"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2024-07-04T13:21:17.247Z"}, "references": [{"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24557"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-05T13:15:28.061716Z", "id": "CVE-2024-22277", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T13:15:34.777Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:43:34.111Z"}, "title": "CVE Program Container", "references": [{"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24557", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24557", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:43:34.111Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-22277", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-05T13:15:28.061716Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T13:15:32.135Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "N/A", "product": "VMware Cloud Director Availability", "versions": [{"status": "affected", "version": "VMware Cloud Director Availability 4.x"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24557"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "VMware Cloud Director Availability contains an HTML injection vulnerability. \nA\n malicious actor with network access to VMware Cloud Director \nAvailability can craft malicious HTML tags to execute within replication\n tasks.", "supportingMedia": [{"type": "text/html", "value": "\nVMware Cloud Director Availability contains an HTML injection vulnerability. \nA\n malicious actor with network access to VMware Cloud Director \nAvailability can craft malicious HTML tags to execute within replication\n tasks. \n\n<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "HTML Injection"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2024-07-04T13:21:17.247Z"}}}, "cveMetadata": {"cveId": "CVE-2024-22277", "state": "PUBLISHED", "dateUpdated": "2024-08-01T22:43:34.111Z", "dateReserved": "2024-01-08T18:43:18.959Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2024-07-04T13:21:17.247Z", "assignerShortName": "vmware"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vmware:cloud_director:*:*:*:*:*:*:*:*", "matchCriteriaId": "7C06DDD1-FB6C-4A11-8786-00702A272D85", "versionEndExcluding": "4.7.2", "versionStartIncluding": "4.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "VMware Cloud Director Availability contains an HTML injection vulnerability. \nA\n malicious actor with network access to VMware Cloud Director \nAvailability can craft malicious HTML tags to execute within replication\n tasks."}, {"lang": "es", "value": "VMware Cloud Director Availability contiene una vulnerabilidad de inyecci\u00f3n de HTML. Un actor malicioso con acceso de red a VMware Cloud Director Availability puede crear etiquetas HTML maliciosas para ejecutarlas dentro de las tareas de replicaci\u00f3n."}], "id": "CVE-2024-22277", "lastModified": "2024-08-21T16:12:46.790", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@vmware.com", "type": "Secondary"}]}, "published": "2024-07-04T14:15:01.990", "references": [{"source": "security@vmware.com", "tags": ["Third Party Advisory"], "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24557"}], "sourceIdentifier": "security@vmware.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}