Skip to content
Sign in
7.8 High

CVE-2024-37081 The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An…

Description

The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance.

CVSS 3.1 detail

Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitable with local access to the machine, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Local
Attack complexity
Low
Privileges required
Low
Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Affected products and versions

Product Affected versions Fixed in
VMware vCenter Server 8.0 8.0 → latest No fix stated
VMware vCenter Server 7.0 7.0 → latest No fix stated
VMware Cloud Foundation 5.x No fix stated
VMware Cloud Foundation 4.x No fix stated
cloud_foundation 4.0 4.0 → < 6.0 6.0
vcenter_server 7.0 earliest → < 7.0u3r 7.0u3r

Other CVEs of VMware vCenter Server

The 14 CVEs of VMware vCenter Server →
CVE-2024-38813 VMware vCenter Server Privilege Escalation Vulnerability 7.5 High CVE-2024-38812 VMware vCenter Server Heap-Based Buffer Overflow Vulnerability 9.8 Critical CVE-2024-37080 vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol 9.8 Critical CVE-2024-37079 Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability 9.8 Critical
Track this CVE