CVE-2024-38834

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources
Severity
4.8MEDIUM
EPSS
0.4%
top 40.49%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Vmware Vmware Aria OperationsVmware Aria OperationsVmware Cloud Foundation
Timeline
PublishedNov 26

Description

VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to cloud provider might be able to inject malicious script leading to stored cross-site scripting in the product VMware Aria Operations.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:NExploitability: 1.3 | Impact: 4.7

Affected Packages3 packages

▶NVDvmware/aria_operations8.0 — 8.18.2
▶CVEListV5vmware/vmware_aria_operations8.x — 8.18.2
▶NVDvmware/cloud_foundation4.0 — 5.2

🔴Vulnerability Details

2
GHSA
GHSA-m2m4-2g99-6625: VMware Aria Operations contains a stored cross-site scripting vulnerability↗2024-11-26
▶
CVEList
Stored cross-site scripting vulnerability (CVE-2024-38834)↗2024-11-26
▶