CVE-2024-22280

published 2024-07-11

CVE-2024-22280: VMware Aria Automation does not apply correct input validation which allows for SQL-injection in the product. An authenticated malicious user could enter…

high 8.1 CVSS 3.1

AV N AC L PR L UI N S U C H I H A N

VMware Aria Automation does not apply correct input validation which allows for SQL-injection in the product. An authenticated malicious user could enter specially crafted SQL queries and perform unauthorised read/write operations in the database.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
vmware	aria_automation	< 8.17.0	8.17.0
vmware	cloud_foundation	4.0 – 5.0	—
vmware	vmware_aria_automation	>= 8.x < 8.17.0	8.17.0

CWE-89