InfoSecBulletin Cybersecurity for mankind
VMware advises users to remove the outdated Enhanced Authentication Plugin (EAP) due to the discovery of a serious authentication relay vulnerability, known as CVE-2024-22245 (CVSS score: 9.6).
A person who intends to harm could deceive a domain user with EAP installed in their web browser. This deception could lead the user to request and relay service tickets for any Active Directory Service Principal Names (SPNs).
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
VMware published an advisory about vulnerabilities in the deprecated VMware Enhanced Authentication Plug-in (EAP). A malicious actor could exploit these vulnerabilities to trick a user with EAP into requesting and relaying service tickets for arbitrary Active Directory Service Principal Names (SPNs). According to the advisory, there are no workarounds for this vulnerability.
The VMware Enhanced Authentication Plugin (EAP) was a software plugin that allowed easy login to vSphere management interfaces using integrated Windows Authentication and smart card functionality on Windows client systems. The plugin was discontinued in 2021 with the release of vCenter Server 7.0u2.
The company fixed a critical session hijack vulnerability in EAP, known as CVE-2024-22250 (CVSS score 7.8).
“A malicious actor with unprivileged local access to a windows operating system can hijack a privileged EAP session when initiated by a privileged domain user on the same system.” continues the advisory.
The vulnerabilities were both reported by Ceri Coburn from Pen Test Partners.
