Security Affairs
Dark Caracal Deploys New Go Malware With Ethereum-Based C2 Fallback|Australian Police Charge Two Over TeamPCP Credential Theft|Meta to Pay Up to $18B Over Teen Social Media Use|CISA Warns Water Utilities: Find Your Exposed PLCs Before Attackers Do|OpenAI banned Russian ChatGPT accounts backing covert influence operation|CISA Red Team Fully Compromised Two Critical Infrastructure Orgs|FBI Seizes China-Linked Hacking Platforms QScan and QTRouter Used Against Critical Infrastructure|U.S. CISA adds Gitea flaw to its Known Exploited Vulnerabilities catalog|88 ID Verification Breaches Show the Cost of Collecting Identity Data|WhatsApp Adds Stronger Security as Passkeys Hit 1 Billion|Operation Jackal: 58 Arrests Expose the Money Laundering Machine Behind Global Scams|Norway ’s Digital Government Infrastructure Hit by a new DDoS Attack|Dark Caracal Deploys New Go Malware With Ethereum-Based C2 Fallback|Australian Police Charge Two Over TeamPCP Credential Theft|Meta to Pay Up to $18B Over Teen Social Media Use|CISA Warns Water Utilities: Find Your Exposed PLCs Before Attackers Do|OpenAI banned Russian ChatGPT accounts backing covert influence operation|CISA Red Team Fully Compromised Two Critical Infrastructure Orgs|FBI Seizes China-Linked Hacking Platforms QScan and QTRouter Used Against Critical Infrastructure|U.S. CISA adds Gitea flaw to its Known Exploited Vulnerabilities catalog|88 ID Verification Breaches Show the Cost of Collecting Identity Data|WhatsApp Adds Stronger Security as Passkeys Hit 1 Billion|Operation Jackal: 58 Arrests Expose the Money Laundering Machine Behind Global Scams|Norway ’s Digital Government Infrastructure Hit by a new DDoS Attack|
Advertisement

Ad Placeholder

Full Width × 90

Breaking News

VMware fixed five vulnerabilities in Aria Operations product

Virtualization giant VMware addressed multiple vulnerabilities in its Aria Operations product that can led to privilege escalation and XSS attacks. VMware released security updates to address five vulnerabilities in its Aria Operations product. Aria Operations (formerly known as VMware vRealize Operations) is a comprehensive cloud management and operations platform developed by VMware. It is designed […]

VMware ESXi Fusion Pwn2Own Berlin 2025

Virtualization giant VMware addressed multiple vulnerabilities in its Aria Operations product that can led to privilege escalation and XSS attacks.

VMware released security updates to address five vulnerabilities in its Aria Operations product. Aria Operations (formerly known as VMware vRealize Operations) is a comprehensive cloud management and operations platform developed by VMware. It is designed to provide IT administrators and cloud professionals with tools to optimize, manage, and troubleshoot their hybrid and multi-cloud environments.

The virtualization giant addressed the following vulnerabilities:

Here are the details from VMware’s VMSA-2024-0022 bulletin: 

  • Local privilege escalation vulnerability (CVE-2024-38830) (CVSS 7.8) – A local admin on VMware Aria Operations can exploit a vulnerability to escalate privileges to root.
  • Local privilege escalation vulnerability (CVE-2024-38831) (CVSS 7.8) – A threat actor with local administrative privileges on VMware Aria Operations can exploit a properties file to execute malicious commands and gain root privileges.
  • Stored cross-site scripting vulnerability (CVE-2024-38832) (CVSS 7.1) – A threat actor with editing access to views may be able to inject malicious script leading to stored cross-site scripting in the product VMware Aria Operations.
  • Stored cross-site scripting vulnerability (CVE-2024-38833) (CVSS 6.8) – An attacker with access to edit email templates in VMware Aria Operations can inject scripts, causing stored cross-site scripting (XSS) vulnerabilities.
  • Stored cross-site scripting vulnerability (CVE-2024-38834) (CVSS 6.5) – An attacker with cloud provider editing access in VMware Aria Operations can inject scripts, causing stored cross-site scripting (XSS) vulnerabilities.

Below is the response matrix published by VMware:

ProductVersionRunning OnCVECVSSv3SeverityFixed versionsWorkaroundAdditional Documents
VMware Aria Operations8.xAnyCVE-2024-38830, CVE-2024-38831, CVE-2024-38832,CVE-2024-38833, CVE-2024-388347.8 , 7.8, 7.1, 6.8, 6.5 Important8.18.2NoneNone
VMware Cloud Foundation (VMware Aria Operations)5.xAnyCVE-2024-38830, CVE-2024-38831, CVE-2024-38832,CVE-2024-38833, CVE-2024-388347.8 , 7.8, 7.1, 6.8, 6.5 Important8.18.2NoneNone
VMware Cloud Foundation (VMware Aria Operations)4.xAnyCVE-2024-38830, CVE-2024-38831, CVE-2024-38832,CVE-2024-38833, CVE-2024-388347.8 , 7.8, 7.1, 6.8, 6.5 Important8.18.2NoneNone

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, VMWARE)

Tags

Hackinghacking newsinformation security newsIT Information SecurityPierluigi PaganiniSecurity AffairsSecurity NewsVMwareVMware Aria AutomationXSS

More Stories>

Dark Caracal Deploys New Go Malware With Ethereum-Based C2 FallbackAPT

Dark Caracal Deploys New Go Malware With Ethereum-Based C2 Fallback

Australian Police Charge Two Over TeamPCP Credential TheftBreaking News

Australian Police Charge Two Over TeamPCP Credential Theft

Meta to Pay Up to $18B Over Teen Social Media UseBreaking News

Meta to Pay Up to $18B Over Teen Social Media Use

Security>

Hacking>

Malware>