VulnerabilityAnalyzed
CVE-2024-38814
An authenticated SQL injection vulnerability in VMware HCX was privately reported to VMware.
HIGH 8.8EPSS 15.4%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 15.4%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
An authenticated SQL injection vulnerability in VMware HCX was privately reported to VMware. A malicious authenticated user with non-administrator privileges may be able to enter specially crafted SQL queries and perform unauthorized remote code execution on the HCX manager. Updates are available to remediate this vulnerability in affected VMware products.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 15.40% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- vmware/vmware hcx
- Source
- security@vmware.com
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.