CVE-2024-38813 - OpenCVE

The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Broadcom	Vmware Center Server Vmware Cloud Foundation

No data.

No data.

References

Link	Providers
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24968

History

Tue, 17 Sep 2024 21:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Broadcom Broadcom vmware Center Server Broadcom vmware Cloud Foundation
CPEs		cpe:2.3:a:broadcom:vmware_center_server:::::::: cpe:2.3:a:broadcom:vmware_cloud_foundation::::::::
Vendors & Products		Broadcom Broadcom vmware Center Server Broadcom vmware Cloud Foundation
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 17 Sep 2024 17:30:00 +0000

Type	Values Removed	Values Added
Description		The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.
Title		Privilege escalation vulnerability
Weaknesses		CWE-250 CWE-273
References		https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24968
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: vmware

Published: 2024-09-17T17:13:13.924Z

Updated: 2024-09-19T13:01:50.788Z

Reserved: 2024-06-19T22:31:57.187Z

Link: CVE-2024-38813

Vulnrichment

Updated: 2024-09-17T20:37:03.455Z

NVD

Status : Received

Published: 2024-09-17T18:15:04.127

Modified: 2024-09-17T18:15:04.127

Link: CVE-2024-38813

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-38813", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2024-06-19T22:31:57.187Z", "datePublished": "2024-09-17T17:13:13.924Z", "dateUpdated": "2024-09-19T13:01:50.788Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "VMware vCenter Server", "vendor": "n/a", "versions": [{"lessThan": "8.0 U3b", "status": "affected", "version": "8.0", "versionType": "custom"}, {"lessThan": "7.0 U3s", "status": "affected", "version": "7.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "VMware Cloud Foundation", "vendor": "n/a", "versions": [{"status": "affected", "version": "5.x"}, {"status": "affected", "version": "4.x"}]}], "datePublic": "2024-09-17T05:08:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">The vCenter Server contains a privilege escalation vulnerability. </span>A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.<span style=\"background-color: rgb(255, 255, 255);\"><br><br></span><br>"}], "value": "The vCenter Server contains a privilege escalation vulnerability.\u00a0A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-273", "description": "CWE-273 Improper Check for Dropped Privileges", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-250", "description": "CWE-250", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2024-09-17T17:13:13.924Z"}, "references": [{"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24968"}], "source": {"discovery": "UNKNOWN"}, "title": "Privilege escalation vulnerability", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "broadcom", "product": "vmware_center_server", "cpes": ["cpe:2.3:a:broadcom:vmware_center_server:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "8.0", "status": "affected", "lessThan": "8.0 U3b", "versionType": "custom"}, {"version": "7.0", "status": "affected", "lessThan": "7.0 U3s", "versionType": "custom"}]}, {"vendor": "broadcom", "product": "vmware_cloud_foundation", "cpes": ["cpe:2.3:a:broadcom:vmware_cloud_foundation:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "5.0", "status": "affected", "lessThan": "6.0", "versionType": "custom"}, {"version": "4.0", "status": "affected", "lessThan": "5.0", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-19T03:55:46.726913Z", "id": "CVE-2024-38813", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-19T13:01:50.788Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-38813", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-09-19T03:55:46.726913Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:broadcom:vmware_center_server:*:*:*:*:*:*:*:*"], "vendor": "broadcom", "product": "vmware_center_server", "versions": [{"status": "affected", "version": "8.0", "lessThan": "8.0 U3b", "versionType": "custom"}, {"status": "affected", "version": "7.0", "lessThan": "7.0 U3s", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:broadcom:vmware_cloud_foundation:*:*:*:*:*:*:*:*"], "vendor": "broadcom", "product": "vmware_cloud_foundation", "versions": [{"status": "affected", "version": "5.0", "lessThan": "6.0", "versionType": "custom"}, {"status": "affected", "version": "4.0", "lessThan": "5.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-17T20:37:03.455Z"}}], "cna": {"title": "Privilege escalation vulnerability", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "n/a", "product": "VMware vCenter Server", "versions": [{"status": "affected", "version": "8.0", "lessThan": "8.0 U3b", "versionType": "custom"}, {"status": "affected", "version": "7.0", "lessThan": "7.0 U3s", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "n/a", "product": "VMware Cloud Foundation", "versions": [{"status": "affected", "version": "5.x"}, {"status": "affected", "version": "4.x"}], "defaultStatus": "unaffected"}], "datePublic": "2024-09-17T05:08:00.000Z", "references": [{"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24968"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The vCenter Server contains a privilege escalation vulnerability.\u00a0A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">The vCenter Server contains a privilege escalation vulnerability. </span>A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.<span style=\"background-color: rgb(255, 255, 255);\"><br><br></span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-273", "description": "CWE-273 Improper Check for Dropped Privileges"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-250", "description": "CWE-250"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2024-09-17T17:13:13.924Z"}}}, "cveMetadata": {"cveId": "CVE-2024-38813", "state": "PUBLISHED", "dateUpdated": "2024-09-19T13:01:50.788Z", "dateReserved": "2024-06-19T22:31:57.187Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2024-09-17T17:13:13.924Z", "assignerShortName": "vmware"}, "dataVersion": "5.1"}