VMware vCenter Server Privilege Escalation Vulnerability

Added Nov. 20, 2024 • Due Dec. 11, 2024 • CVE-2024-38813

Overdue VMware / vCenter Server CWE-250 CWE-273

Description

VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet.

Required Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

References

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24968
https://nvd.nist.gov/vuln/detail/CVE-2024-38813

Additional Information

Catalog Version: 2025.01.24
Catalog Released: Jan. 24, 2025
Days Until Due: 0 days
Last Updated: 4 months, 2 weeks ago