InfoSecBulletin Cybersecurity for mankind
VMware revealed several critical vulnerabilities in its Aria Operations product, with the most severe allowing attackers to gain root user privileges on affected systems.
The advisory, VMSA-2024-0022, released on November 26, 2024, addresses five distinct vulnerabilities:
Daily Security Update Dated: 04.12.2024
JP CERT warns I-O DATA zero-day router flaws:Update Needed!
Telecoms on High Alert: CISA, NSA, FBI Publish joint guideline
CISA Flags 3 Actively Exploited Vulnerabilities in KEV
Cisco Confirms Active Exploitation Of Decade-Old WebVPN Vulnerability
TP-Link Archer Security Flaw Exposes Devices to Malicious Command Injection
IBM address multiple flaw in security verify access appliance
“Rockstar 2FA” Targets Microsoft 365 Users with AiTM Attacks
Workshop on “DDoS use cases & solutions for government & BFSI” held at BCS
Uganda confirms hack of central bank accounts, Refutes $17 Million Claim
CVE-2024-38831 is a local privilege escalation vulnerability with a CVSSv3 score of 7.8.
CVE-2024-38832 is a stored XSS vulnerability that has a CVSSv3 score of 7.1.
CVE-2024-38833 is a stored XSS vulnerability with a CVSSv3 score of 6.8.
CVE-2024-38834: A third stored XSS vulnerability with a CVSSv3 score of 6.5.
Stored XSS vulnerabilities (CVE-2024-38832, CVE-2024-38833, CVE-2024-38834) let attackers with editing permissions inject harmful scripts into views, email templates, and cloud provider settings. These scripts can run when other users access those parts of the application.
Vulnerabilities affect VMware Aria Operations versions 8.x up to 8.18.1, as well as VMware Cloud Foundation versions 4.x and 5.x that include it.
Patches Released:
VMware has issued patches for vulnerabilities, and users should update to version 8.18.2 of VMware Aria Operations to fix all five issues. Since there are no workarounds, it’s important for organizations to apply the patches promptly.
VMware has recognized several security researchers, including those from MoyunSec Vlab, Bing, and the Michelin CERT team, for responsibly reporting vulnerabilities.
