CVE-2024-38833

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources
Severity
5.4MEDIUM
EPSS
0.2%
top 54.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Vmware Vmware Aria OperationsVmware Aria OperationsVmware Cloud Foundation
Timeline
PublishedNov 26

Description

VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to email templates might inject malicious script leading to stored cross-site scripting in the product VMware Aria Operations.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:LExploitability: 2.1 | Impact: 4.7

Affected Packages3 packages

▶NVDvmware/aria_operations8.0 — 8.18.2
▶CVEListV5vmware/vmware_aria_operations8.x — 8.18.2
▶NVDvmware/cloud_foundation4.0 — 5.2

🔴Vulnerability Details

2
GHSA
GHSA-mff4-qp47-8h8q: VMware Aria Operations contains a stored cross-site scripting vulnerability↗2024-11-26
▶
CVEList
Stored cross-site scripting vulnerability (CVE-2024-38833)↗2024-11-26
▶