Lucene search
VmwareCVELIST:CVE-2024-22280HistoryJul 11, 2024 - 4:39 a.m.
CVE-2024-22280 VMSA-2024-0017: VMware Aria Automation updates address SQL-injection vulnerability (CVE-2024-22280)
2024-07-1104:39:09
vmware
www.cve.org
9
vmware
aria automation
sql-injection
vulnerability
patch
database
CVSS3
8.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
EPSS
0.001
Percentile
16.6%
VMware Aria Automation does not apply correct input validation which allows for SQL-injection in the product. An authenticated malicious user could enter specially crafted SQL queries and perform unauthorised read/write operations in the database.
CNA Affected
[
{
"defaultStatus": "unaffected",
"product": "VMware Aria Automation",
"vendor": "VMware",
"versions": [
{
"lessThan": "8.17.0",
"status": "affected",
"version": "8.x",
"versionType": "8.17.0"
}
]
}
]Related
vulnrichment
vulnrichment
cve
cve
CVE-2024-22280
2024-07-11 05:15:10
nessus
nessus
VMware Aria Automation SQLi Vulnerability (VMSA-2024-0017)
2024-07-18 00:00:00
nvd
nvd
CVE-2024-22280
2024-07-11 05:15:10
thn
thn
GitLab Patches Critical Flaw Allowing Unauthorized Pipeline Jobs
2024-07-11 03:51:00
CVSS3
8.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
EPSS
0.001
Percentile
16.6%
Related for CVELIST:CVE-2024-22280