VULNERABILITY INTELLIGENCE

CVE-2024-38814

CVSS score8.8 HIGH
EPSS probability15.40%
CISA KEVNot currently listed
Published2024-10-16
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

An authenticated SQL injection vulnerability in VMware HCX was privately reported to VMware. A malicious authenticated user with non-administrator privileges may be able to enter specially crafted SQL queries and perform unauthorized remote code execution on the HCX manager.  Updates are available to remediate this vulnerability in affected VMware products.

Weakness classification

  • security@vmware.com: CWE-89
  • nvd@nist.gov: CWE-89

Primary references