CVE-2024-38814

Name of the Vulnerable Software and Affected Versions VMware HCX versions prior to 4.8.3 VMware HCX versions prior to 4.9.2 VMware HCX versions prior to 4.10.1

Description An authenticated SQL injection flaw exists in the listExtensions method of VMware Hybrid Cloud Extension (HCX). Successful exploitation allows a malicious, authenticated user with non-administrator privileges to execute arbitrary code on the HCX manager by submitting specially crafted SQL queries. The vulnerability is identified as CVE-2024-38814 and has a CVSS score of 8.8 (High). The vulnerability resides in the way the software handles the structure of SQL requests, failing to implement adequate protection measures.

Recommendations Update to VMware HCX version 4.8.3 or later. Update to VMware HCX version 4.9.2 or later. Update to VMware HCX version 4.10.1 or later.