InfoSecBulletin Cybersecurity for mankind
VMware revealed several critical vulnerabilities in its Aria Operations product, with the most severe allowing attackers to gain root user privileges on affected systems.
The advisory, VMSA-2024-0022, released on November 26, 2024, addresses five distinct vulnerabilities:
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
CVE-2024-38831 is a local privilege escalation vulnerability with a CVSSv3 score of 7.8.
CVE-2024-38832 is a stored XSS vulnerability that has a CVSSv3 score of 7.1.
CVE-2024-38833 is a stored XSS vulnerability with a CVSSv3 score of 6.8.
CVE-2024-38834: A third stored XSS vulnerability with a CVSSv3 score of 6.5.
Stored XSS vulnerabilities (CVE-2024-38832, CVE-2024-38833, CVE-2024-38834) let attackers with editing permissions inject harmful scripts into views, email templates, and cloud provider settings. These scripts can run when other users access those parts of the application.
Vulnerabilities affect VMware Aria Operations versions 8.x up to 8.18.1, as well as VMware Cloud Foundation versions 4.x and 5.x that include it.
Patches Released:
VMware has issued patches for vulnerabilities, and users should update to version 8.18.2 of VMware Aria Operations to fix all five issues. Since there are no workarounds, it’s important for organizations to apply the patches promptly.
VMware has recognized several security researchers, including those from MoyunSec Vlab, Bing, and the Michelin CERT team, for responsibly reporting vulnerabilities.
