cve-2024-22275
Vulnerability from cvelistv5
Published
2024-05-21 17:29
Modified
2025-03-27 19:25
Severity ?
4.9 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Summary
The vCenter Server contains a partial file read vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to partially read arbitrary files containing sensitive data.
References
security@vmware.comhttps://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24308Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24308Vendor Advisory
Impacted products
n/aVMware vCenter Server
n/aVMware Cloud Foundation (vCenter Server)
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-22275",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-21T19:06:55.459940Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-27T19:25:13.775Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:43:34.230Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24308"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "VMware vCenter Server",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "8.0 U2b",
              "status": "affected",
              "version": "8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0 U3q",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "VMware Cloud Foundation (vCenter Server)",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "5.1.1",
              "status": "affected",
              "version": "5.x",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe vCenter Server contains a partial file read vulnerability.\u0026nbsp;\u003c/span\u003eA malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to partially read arbitrary files containing sensitive data.\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cbr\u003e\u003cbr\u003e\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "The vCenter Server contains a partial file read vulnerability.\u00a0A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to partially read arbitrary files containing sensitive data."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Partial file read vulnerability",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-21T17:29:45.562Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24308"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2024-22275",
    "datePublished": "2024-05-21T17:29:45.562Z",
    "dateReserved": "2024-01-08T18:43:18.958Z",
    "dateUpdated": "2025-03-27T19:25:13.775Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-22275\",\"sourceIdentifier\":\"security@vmware.com\",\"published\":\"2024-05-21T18:15:09.383\",\"lastModified\":\"2025-06-27T13:38:06.967\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The vCenter Server contains a partial file read vulnerability.\u00a0A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to partially read arbitrary files containing sensitive data.\"},{\"lang\":\"es\",\"value\":\" vCenter Server contiene una vulnerabilidad de lectura parcial de archivos. Un actor malintencionado con privilegios administrativos en el shell del dispositivo vCenter puede aprovechar este problema para leer parcialmente archivos arbitrarios que contengan datos confidenciales.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@vmware.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":4.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.2,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.0\",\"versionEndExcluding\":\"5.1.1\",\"matchCriteriaId\":\"FA6C5CFA-E78F-46EA-B8E0-8AE2A29C9586\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"5FA81CCD-A05E-498C-820E-21980E92132F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:*\",\"matchCriteriaId\":\"0EE83406-A3D9-4F75-A1A6-63831CEBEEC1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:*\",\"matchCriteriaId\":\"FB563627-C9CF-4D8A-B882-9AB65EAE9E15\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:*\",\"matchCriteriaId\":\"DCA03B2A-48B2-48AD-B8EB-9D7BB2016819\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:*\",\"matchCriteriaId\":\"A2392D0F-D7A2-4E01-9212-1BA6C895AEBF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D731C1A-9FE5-461C-97E2-6F45E4CBABE1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:*\",\"matchCriteriaId\":\"8725E544-2A94-4829-A683-1ECCE57A74A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:7.0:update1c:*:*:*:*:*:*\",\"matchCriteriaId\":\"0FC6765A-6584-45A8-9B21-4951D2EA8939\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:7.0:update1d:*:*:*:*:*:*\",\"matchCriteriaId\":\"85DD238C-EF73-44F0-928E-A94FF5C4B378\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:7.0:update2:*:*:*:*:*:*\",\"matchCriteriaId\":\"F4CA36C1-732E-41AE-B847-F7411B753F3D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:7.0:update2a:*:*:*:*:*:*\",\"matchCriteriaId\":\"0DA882B6-D811-4E4B-B614-2D48F0B9036E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:7.0:update2b:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D30A78E-16D0-4A2E-A2F8-F6073698243E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:7.0:update2c:*:*:*:*:*:*\",\"matchCriteriaId\":\"188E103E-9568-4CE0-A984-141B2A9E82D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:7.0:update2d:*:*:*:*:*:*\",\"matchCriteriaId\":\"B266439F-E911-4C95-9D27-88DF96DDCCD5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:7.0:update3:*:*:*:*:*:*\",\"matchCriteriaId\":\"6508A908-EF14-4A72-AC75-5DA6F8B98A0E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:7.0:update3a:*:*:*:*:*:*\",\"matchCriteriaId\":\"3BAD2012-5C82-4EA9-A780-9BF1DA5A18AB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:7.0:update3c:*:*:*:*:*:*\",\"matchCriteriaId\":\"58597F18-0B23-4D21-9ABA-D9773958F10E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:7.0:update3d:*:*:*:*:*:*\",\"matchCriteriaId\":\"ADF46C54-313B-4742-A074-EEA0A6554680\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:7.0:update3e:*:*:*:*:*:*\",\"matchCriteriaId\":\"9587F800-57BC-44B6-870E-95691684FC46\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:7.0:update3f:*:*:*:*:*:*\",\"matchCriteriaId\":\"AD148A75-5076-416D-AFD6-0F281DA0A82B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:7.0:update3g:*:*:*:*:*:*\",\"matchCriteriaId\":\"956CEA8C-F8C4-41BD-85B4-44FE3A772E50\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:7.0:update3h:*:*:*:*:*:*\",\"matchCriteriaId\":\"008AEA0F-116B-4AF8-B3A7-3041CCE25235\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:7.0:update3i:*:*:*:*:*:*\",\"matchCriteriaId\":\"EE486B2F-AED4-4FCE-A674-DFC25844FEFF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:7.0:update3j:*:*:*:*:*:*\",\"matchCriteriaId\":\"4F73AA9E-51E9-4FA0-813D-AD05FDC3EF94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:7.0:update3k:*:*:*:*:*:*\",\"matchCriteriaId\":\"455DD46E-A071-476D-8914-767485E45F35\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:7.0:update3l:*:*:*:*:*:*\",\"matchCriteriaId\":\"3A422D04-48DF-4A16-94F8-D5702CC2782D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:7.0:update3m:*:*:*:*:*:*\",\"matchCriteriaId\":\"806E9219-CDF4-4E62-978E-334E96A94BA6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:7.0:update3n:*:*:*:*:*:*\",\"matchCriteriaId\":\"34D8B182-4E71-4655-8DD8-743A3EF6DC8B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:7.0:update3o:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D8F6CC7-6B6D-4079-9E2C-A85C4616FF92\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:7.0:update3p:*:*:*:*:*:*\",\"matchCriteriaId\":\"A814F0AB-4AEB-4139-976F-425A4A9EC67B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:8.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"CC974CA1-88D3-42E4-BF1F-28870F8171B5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:8.0:a:*:*:*:*:*:*\",\"matchCriteriaId\":\"EFE63984-F69B-4593-9AEC-D179D6D98B08\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:8.0:b:*:*:*:*:*:*\",\"matchCriteriaId\":\"34D1F3B3-8E3F-4E4D-8EE6-2F593663B5CC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:8.0:c:*:*:*:*:*:*\",\"matchCriteriaId\":\"16F3D992-9F48-4604-9AAF-DC2D1CE98BE2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:8.0:update1:*:*:*:*:*:*\",\"matchCriteriaId\":\"C745A7E6-4760-48CD-B7C4-1C2C20217F21\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:8.0:update1a:*:*:*:*:*:*\",\"matchCriteriaId\":\"A5522514-8ED9-45DB-9036-33FE40D77E7D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:8.0:update1b:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C27C660-E917-4944-8B4C-41D9622B76D7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:8.0:update1c:*:*:*:*:*:*\",\"matchCriteriaId\":\"56CFB469-B3E6-4503-A47C-D18206D4D19A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:8.0:update1d:*:*:*:*:*:*\",\"matchCriteriaId\":\"67024A43-9E13-4F4E-B711-731792DA3840\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:8.0:update1e:*:*:*:*:*:*\",\"matchCriteriaId\":\"1188E9D6-53AD-40D0-8146-3728D071008D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:8.0:update2:*:*:*:*:*:*\",\"matchCriteriaId\":\"604F559F-1775-4F29-996E-9079B99345B6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vcenter_server:8.0:update2a:*:*:*:*:*:*\",\"matchCriteriaId\":\"61DC9400-5AEE-49AC-9925-0A96E32BD8C0\"}]}]}],\"references\":[{\"url\":\"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24308\",\"source\":\"security@vmware.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24308\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.