Lucene search

VmwareCVE-2024-38811

HistorySep 03, 2024 - 10:15 a.m.

CVE-2024-38811

2024-09-0310:15:05

CWE-20

vmware

web.nvd.nist.gov

vmware fusion

code-execution

environment variable

security vulnerability

malicious actor

CVSS3

8.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

Percentile

5.1%

JSON

VMware Fusion (13.x before 13.6) contains a code-execution vulnerability due to the usage of an insecure environment variable. A malicious actor with standard user privileges may exploit this vulnerability to execute code in the context of the Fusion application.

Affected configurations

Nvd

Node

vmwarefusionRange13.0.0–13.6

VendorProductVersionCPE
vmwarefusion*cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
vmware	fusion	*	cpe:2.3:a:vmware:fusion::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "MacOS"
    ],
    "product": "Fusion",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "13.6",
        "status": "affected",
        "version": "13.x",
        "versionType": "custom"
      }
    ]
  }
]

References

support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24939

CVSS3

8.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2024-38811