CVE-2024-38814CWE-89

An authenticated SQL injection vulnerability in VMware HCX was privately reported to VMware

High · published October 16, 2024

CVSS v3.1
8.8
EPSS
15%
Percentile
96.8
In the wild
Unconfirmed
What it is

An authenticated SQL injection vulnerability in VMware HCX was privately reported to VMware. A

malicious authenticated user with non-administrator privileges may be

able to enter specially crafted SQL queries and perform unauthorized

remote code execution on the HCX manager.

Updates are available to remediate this vulnerability in affected VMware products.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.15405 · 96.8th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2024-10-16T16:59Z
EPSS history
Timeline
  • 16 OCT 16:59Z
    An authenticated SQL injection vulnerability in VMware HCX was privately reported to VMware
    cvelistv5