CVE-2024-38814

high · 8.8

An authenticated SQL injection vulnerability in VMware HCX was privately reported to VMware. A malicious authenticated user with non-administrator privileges may be able to enter specially crafted SQL queries and perform unauthorized remote code execution on the HCX manager. Updates are available to remediate this vulnerability in affected VMware products.

8.8

CVSS

15.4%

EPSS (exploit prob.)

97th

EPSS percentile

2024-10-16

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
vmware	vmware_hcx	>= 4.8.0, <= 4.8.2
vmware	vmware_hcx	>= 4.9.0, <= 4.9.1
vmware	vmware_hcx	4.10.0

Check a specific version with /api/v1/cve/match.

References

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25019

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-38814