VMSA-2024-0017: VMware Aria Automation updates address SQL-injection vulnerability (CVE-2024-22280)

VMware Aria Automation

0 more products

24598

11 July 2024

10 July 2024

OPEN

HIGH

 

 

Advisory ID: 

VMSA-2024-0017

Advisory Severity: Important
CVSSv3 Range: 8.5
Synopsis: VMware Aria Automation updates address SQL-injection vulnerability (CVE-2024-22280)
Issue date:

2024-07-10

Updated on:

2024-07-10

CVE(s) CVE-2024-22280

 

1. Impacted Products

  • VMware Aria Automation

2. Introduction

An SQL-injection vulnerability in VMware Aria Automation was privately reported to VMware. Patches and workarounds are available to remediate or workaround this vulnerability in the affected VMware product. 

3. SQL Injection vulnerability in VMware Aria Automation (CVE-2024-22280)

Description:

VMware Aria Automation does not apply correct input validation which allows for SQL-injection in the product. VMware has evaluated the severity of this issue to be in the important severity range with a maximum CVSSv3 base score of 8.5

Known Attack Vectors:

An authenticated malicious user could enter specially crafted SQL queries and perform unauthorised read/write operations in the database.

Resolution:

To remediate CVE-2024-22280 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.


Workarounds:
None.

Additional Documentation:
None.

Acknowledgements:
VMware would like to thank Alexandre Lavoie and Felix Boulet with the Centre gouvernemental de cyberdéfense (CGCD) for reporting this issue to us.

Notes:
None.

Response Matrix:

Product

Version

Running On

CVE
CVSSv3

Severity

Fixed Version

Workarounds

Additional Documents

VMware Aria Automation 8.17.0 Any Unaffected Unaffected Unaffected Unaffected None None
VMware Aria Automation 8.x Any CVE-2024-22280 8.5 Important KB325790 None None
VMware Cloud Foundation 5.x, 4.x Any CVE-2024-22280 8.5 Important KB325790 None None

4. References:

Fixed Version(s) and Release Notes:

KB325790

https://docs.vmware.com/en/VMware-Aria-Automation/services/rn/vmware-aria-automation-release-notes/index.html

Additional Documentation:

None

Mitre CVE Dictionary Links:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22280

FIRST CVSSv3 Calculator:

https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

5. Change Log:

 : VMSA-2024-0017
Initial security advisory.

6. Contact:

E-mail: [email protected]

PGP key at:
https://kb.vmware.com/kb/1055

VMware Security Advisories
http://www.vmware.com/security/advisories

VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html

VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html

VMware Security & Compliance Blog
https://blogs.vmware.com/security

Twitter
https://twitter.com/VMwareSRC

Copyright 2024 Broadcom All rights reserved.