VMSA-2024-0017: VMware Aria Automation updates address SQL-injection vulnerability (CVE-2024-22280)
24598
14 February 2025
10 July 2024
OPEN
HIGH
CVE-2024-22280
| Advisory ID: |
VMSA-2024-0017 |
| Advisory Severity: | Important |
| CVSSv3 Range: | 8.5 |
| Synopsis: | VMware Aria Automation updates address SQL-injection vulnerability (CVE-2024-22280) |
| Issue date: |
2024-07-10 |
| Updated on: |
2024-07-10 |
| CVE(s) | CVE-2024-22280 |
1. Impacted Products
- VMware Aria Automation
2. Introduction
An SQL-injection vulnerability in VMware Aria Automation was privately reported to VMware. Patches and workarounds are available to remediate or workaround this vulnerability in the affected VMware product.
3. SQL Injection vulnerability in VMware Aria Automation (CVE-2024-22280)
Description:
VMware Aria Automation does not apply correct input validation which allows for SQL-injection in the product. VMware has evaluated the severity of this issue to be in the important severity range with a maximum CVSSv3 base score of 8.5.
Known Attack Vectors:
An authenticated malicious user could enter specially crafted SQL queries and perform unauthorised read/write operations in the database.
Resolution:
To remediate CVE-2024-22280 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.
Workarounds:
None.
Additional Documentation:
None.
Acknowledgements:
VMware would like to thank Alexandre Lavoie and Felix Boulet with the Centre gouvernemental de cyberdéfense (CGCD) for reporting this issue to us.
Notes:
None.
Response Matrix:
|
Product |
Version |
Running On |
CVE
|
CVSSv3
|
Severity |
Fixed Version |
Workarounds |
Additional Documents |
|---|---|---|---|---|---|---|---|---|
| VMware Aria Automation | 8.17.0 | Any | Unaffected | Unaffected | Unaffected | Unaffected | None | None |
| VMware Aria Automation | 8.x | Any | CVE-2024-22280 | 8.5 | Important | KB325790 | None | None |
| VMware Cloud Foundation | 5.x, 4.x | Any | CVE-2024-22280 | 8.5 | Important | KB325790 | None | None |
4. References:
Fixed Version(s) and Release Notes:
Additional Documentation:
None
Mitre CVE Dictionary Links:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22280
FIRST CVSSv3 Calculator:
https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
5. Change Log:
: VMSA-2024-0017
Initial security advisory.
6. Contact:
E-mail: [email protected]
PGP key at:
https://kb.vmware.com/kb/1055
VMware Security Advisories
http://www.vmware.com/security/advisories
VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html
VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html
VMware Security & Compliance Blog
https://blogs.vmware.com/security
Twitter
https://twitter.com/VMwareSRC
Copyright 2024 Broadcom All rights reserved.