Multiple VMware Products Vulnerabilities

January 9, 2025

Severity

Medium

Analysis Summary

CVE-2024-38821 CVSS:9.1

VMware Tanzu Spring Security could allow a remote attacker to bypass security restrictions, caused by improper authorization validation. By sending a specially crafted request, an attacker could exploit this vulnerability to bypass authorization rules for static resources in WebFlux Applications.

CVE-2024-38828 CVSS:5.3

VMware Tanzu Spring MVC is vulnerable to a denial of service, caused by an error in controller methods with an @RequestBody byte[] method parameter. A remote attacker could exploit this vulnerability to cause a denial of service.

CVE-2024-38830 CVSS:7.8

VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges may trigger this vulnerability to escalate privileges to root user on the appliance running VMware Aria Operations.

CVE-2024-38831 CVSS:7.8

VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges can insert malicious commands into the properties file to escalate privileges to a root user on the appliance running VMware Aria Operations.

CVE-2024-38832 CVSS:7.1

VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to views may be able to inject malicious script leading to stored cross-site scripting in the product VMware Aria Operations.

CVE-2024-38833 CVSS:6.8

VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to email templates might inject malicious script leading to stored cross-site scripting in the product VMware Aria Operations.

CVE-2024-38834 CVSS:6.5

VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to cloud provider might be able to inject malicious script leading to stored cross-site scripting in the product VMware Aria Operations.

CVE-2024-38827 CVSS:4.8

VMware Tanzu Spring Security could allow a remote attacker to bypass security restrictions, caused by a locale dependent exceptions issue in the useage of String.toLowerCase() and String.toUpperCase() fimctopms. By sending a specially crafted request, an attacker could exploit this vulnerability to bypass authorization rules.

CVE-2024-38829 CVSS:3.7

VMware Tanzu Spring LDAP could allow a remote attacker to obtain sensitive information. The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried. An attacker could exploit this vulnerability to allow data exposure for case sensitive comparisons.

CVE-2024-38819 CVSS:7.5

VMware Tanzu Spring Framework could allow a remote attacker to traverse directories on the system, caused by improper validation of user request by the functional web frameworks WebMvc.fn or WebFlux.fn. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

Impact