← Back

CVE-2024-22274

nvd nist
Published: May 21, 2024Modified: Jun 17, 2026

JSON object

Loading...
7.2
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.2 / Impact: 5.9
Source: security@vmware.com (Secondary)

Description

The vCenter Server contains an authenticated remote code execution vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to run arbitrary commands on the underlying operating system.

Affected (43)

Vmware
2 products
Cloud Foundation
Vcenter Server
Configuration A
43 vulnerable
Vulnerable SoftwareAffected Versions
Cloud Foundation
From 4.0 to 5.1.1
Vmware
Vcenter Server
Version 7.0
Vcenter Server
Version 7.0 a
Vcenter Server
Version 7.0 b
Vcenter Server
Version 7.0 c
Vcenter Server
Version 7.0 d
Vcenter Server
Version 7.0 update1
Vcenter Server
Version 7.0 update1a
Vcenter Server
Version 7.0 update1c
Vcenter Server
Version 7.0 update1d
Vcenter Server
Version 7.0 update2
Vcenter Server
Version 7.0 update2a
Vcenter Server
Version 7.0 update2b
Vcenter Server
Version 7.0 update2c
Vcenter Server
Version 7.0 update2d
Vcenter Server
Version 7.0 update3
Vcenter Server
Version 7.0 update3a
Vcenter Server
Version 7.0 update3c
Vcenter Server
Version 7.0 update3d
Vcenter Server
Version 7.0 update3e
Vcenter Server
Version 7.0 update3f
Vcenter Server
Version 7.0 update3g
Vcenter Server
Version 7.0 update3h
Vcenter Server
Version 7.0 update3i
Vcenter Server
Version 7.0 update3j
Vcenter Server
Version 7.0 update3k
Vcenter Server
Version 7.0 update3l
Vcenter Server
Version 7.0 update3m
Vcenter Server
Version 7.0 update3n
Vcenter Server
Version 7.0 update3o
Vcenter Server
Version 7.0 update3p
Vcenter Server
Version 8.0
Vcenter Server
Version 8.0 a
Vcenter Server
Version 8.0 b
Vcenter Server
Version 8.0 c
Vcenter Server
Version 8.0 update1
Vcenter Server
Version 8.0 update1a
Vcenter Server
Version 8.0 update1b
Vcenter Server
Version 8.0 update1c
Vcenter Server
Version 8.0 update1d
Vcenter Server
Version 8.0 update1e
Vcenter Server
Version 8.0 update2
Vcenter Server
Version 8.0 update2a

Related CWEs

CWE-94
Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (2)

Source: security@vmware.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.