Detections
Analytics
VMware vCenter Server 7.0 < 7.0U3r / 8.0 < 8.0U2d Multiple Vulnerabilities (VMSA-2024-0012)
critical Nessus Plugin ID 200746
Language:
Synopsis
The VMware vCenter Server is affected by multiple vulnerabilities.Description
The version of VMware vCenter Server installed on the remote host is 7.0 prior to 7.0U3r, or 8.0 prior to 8.0U2d. It is, therefore, affected by a partial information disclosure vulnerability as referenced in the VMSA-2024-0012 advisory:- The vCenter Server contains multiple heap-overflow vulnerabilities in the implementation of the DCERPC protocol. (CVE-2024-37079, CVE-2024-37080)
- The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. (CVE-2024-37081) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to VMware vCenter Server 7.0U3r, or 8.0U2d or later.See Also
http://www.nessus.org/u?448f7cb3
https://core.vmware.com/resource/vmsa-2024-0012-questions-answers
Plugin Details
Severity: Critical
ID: 200746
File Name: vmware_vcenter_server_vmsa-2024-0012.nasl
Version: 1.3
Type: remote
Family: Misc.
Published: 6/19/2024
Updated: 6/24/2024
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Critical
Score: 9.2
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2024-37079
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS Score Source: CVE-2024-37080
Vulnerability Information
CPE: cpe:/a:vmware:vcenter_server
Required KB Items: Host/VMware/release, Host/VMware/version, Host/VMware/vCenter
Exploit Ease: No known exploits are available
Patch Publication Date: 6/18/2024
Vulnerability Publication Date: 6/18/2024
Reference Information
CVE: CVE-2024-37079, CVE-2024-37080, CVE-2024-37081
IAVA: 2024-A-0362
VMSA: 2024-0012