CVE-2024-37081

2024-06-1805:43:20

vmware

github.com

vcenter server

local privilege escalation

misconfiguration

sudo

authenticated user

non-administrative privileges

root privilege

vcenter server appliance

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "VMware vCenter Server",
    "versions": [
      {
        "status": "affected",
        "version": "8.0",
        "lessThan": "8.0 U2d",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "7.0",
        "lessThan": "7.0 U3r",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "n/a",
    "product": "VMware Cloud Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "5.x"
      },
      {
        "status": "affected",
        "version": "4.x"
      }
    ],
    "defaultStatus": "unaffected"
  }
]