CVE-2024-38832

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources
Severity
6.4MEDIUM
EPSS
0.4%
top 39.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Vmware Vmware Aria OperationsVmware Aria OperationsVmware Cloud Foundation
Timeline
PublishedNov 26

Description

VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to views may be able to inject malicious script leading to stored cross-site scripting in the product VMware Aria Operations.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:LExploitability: 2.8 | Impact: 4.2

Affected Packages3 packages

▶NVDvmware/aria_operations8.0 — 8.18.2
▶CVEListV5vmware/vmware_aria_operations8.x — 8.18.2
▶NVDvmware/cloud_foundation4.0 — 5.2

🔴Vulnerability Details

2
GHSA
GHSA-6vqg-wm4f-f8vx: VMware Aria Operations contains a stored cross-site scripting vulnerability↗2024-11-26
▶
CVEList
Stored cross-site scripting vulnerability (CVE-2024-38832)↗2024-11-26
▶