VMware · vCenter Server
CVE-2024-38813
Privilege escalation vulnerability
Nedir
The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.
CISA: VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet.
Ne yapmalı
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
ABD federal kurumları için son tarih: 11 Aralık 2024
VMware için istismar edilen diğer açıklar
| Eklenme | Açık | Ürün | Önem | Saldırı olasılığı |
|---|---|---|---|---|
| 20 Kas 2024 | Heap-Based Buffer Overflow | vCenter Server | Kritik 9,8 | 55% |
| 17 Tem 2024 | Incorrect Default File Permissions Vulnerability | vCenter Server | Orta 6,5 | 13% |
| 22 Oca 2024 | Out-of-Bounds Write | vCenter Server | Kritik 9,8 | 99,2% |
| 10 Oca 2022 | Improper Access Control | vCenter Server | Orta 5,3 | 49% |
| 3 Kas 2021 | Information Disclosure | vCenter Server | Kritik 9,8 | 90% |
| 3 Kas 2021 | Remote Code Execution | vCenter Server | Kritik 9,8 | 99,9% |
| 3 Kas 2021 | Improper Input Validation | vCenter Server | Kritik 9,8 | >99,9% |
| 3 Kas 2021 | File Upload | vCenter Server | Kritik 9,8 | >99,9% |
Kaynaklar: Known Exploited Vulnerabilities (CISA, kamu malı), CVE records (cve.org) ve EPSS (FIRST). Saldırı olasılığı, birinin önümüzdeki 30 günde açığı istismar etmeye çalışacağına dair EPSS tahminidir.