FKIE_CVE-2024-38812

Vulnerability from fkie_nvd - Published: 2024-09-17 18:15 - Updated: 2025-10-31 15:57
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.
References
security@vmware.comhttps://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24968Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38812US Government Resource
Impacted products
Vendor Product Version
vmware cloud_foundation *
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 7.0
vmware vcenter_server 8.0
vmware vcenter_server 8.0
vmware vcenter_server 8.0
vmware vcenter_server 8.0
vmware vcenter_server 8.0
vmware vcenter_server 8.0
vmware vcenter_server 8.0
vmware vcenter_server 8.0
vmware vcenter_server 8.0
vmware vcenter_server 8.0
vmware vcenter_server 8.0
vmware vcenter_server 8.0
vmware vcenter_server 8.0
vmware vcenter_server 8.0
vmware vcenter_server 8.0
To clipboard 

{
  "cisaActionDue": "2024-12-11",
  "cisaExploitAdd": "2024-11-20",
  "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
  "cisaVulnerabilityName": "VMware vCenter Server Heap-Based Buffer Overflow Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7FA8DFE6-9C74-4711-A8AF-3B170876A1F9",
              "versionEndExcluding": "5.2",
              "versionStartIncluding": "4.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "5FA81CCD-A05E-498C-820E-21980E92132F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:*",
              "matchCriteriaId": "0EE83406-A3D9-4F75-A1A6-63831CEBEEC1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:*",
              "matchCriteriaId": "FB563627-C9CF-4D8A-B882-9AB65EAE9E15",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:*",
              "matchCriteriaId": "DCA03B2A-48B2-48AD-B8EB-9D7BB2016819",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:*",
              "matchCriteriaId": "A2392D0F-D7A2-4E01-9212-1BA6C895AEBF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:*",
              "matchCriteriaId": "6D731C1A-9FE5-461C-97E2-6F45E4CBABE1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:*",
              "matchCriteriaId": "8725E544-2A94-4829-A683-1ECCE57A74A6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update1c:*:*:*:*:*:*",
              "matchCriteriaId": "0FC6765A-6584-45A8-9B21-4951D2EA8939",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update1d:*:*:*:*:*:*",
              "matchCriteriaId": "85DD238C-EF73-44F0-928E-A94FF5C4B378",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update2:*:*:*:*:*:*",
              "matchCriteriaId": "F4CA36C1-732E-41AE-B847-F7411B753F3D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update2a:*:*:*:*:*:*",
              "matchCriteriaId": "0DA882B6-D811-4E4B-B614-2D48F0B9036E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update2b:*:*:*:*:*:*",
              "matchCriteriaId": "8D30A78E-16D0-4A2E-A2F8-F6073698243E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update2c:*:*:*:*:*:*",
              "matchCriteriaId": "188E103E-9568-4CE0-A984-141B2A9E82D2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update2d:*:*:*:*:*:*",
              "matchCriteriaId": "B266439F-E911-4C95-9D27-88DF96DDCCD5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3:*:*:*:*:*:*",
              "matchCriteriaId": "6508A908-EF14-4A72-AC75-5DA6F8B98A0E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3a:*:*:*:*:*:*",
              "matchCriteriaId": "3BAD2012-5C82-4EA9-A780-9BF1DA5A18AB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3c:*:*:*:*:*:*",
              "matchCriteriaId": "58597F18-0B23-4D21-9ABA-D9773958F10E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3d:*:*:*:*:*:*",
              "matchCriteriaId": "ADF46C54-313B-4742-A074-EEA0A6554680",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3e:*:*:*:*:*:*",
              "matchCriteriaId": "9587F800-57BC-44B6-870E-95691684FC46",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3f:*:*:*:*:*:*",
              "matchCriteriaId": "AD148A75-5076-416D-AFD6-0F281DA0A82B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3g:*:*:*:*:*:*",
              "matchCriteriaId": "956CEA8C-F8C4-41BD-85B4-44FE3A772E50",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3h:*:*:*:*:*:*",
              "matchCriteriaId": "008AEA0F-116B-4AF8-B3A7-3041CCE25235",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3i:*:*:*:*:*:*",
              "matchCriteriaId": "EE486B2F-AED4-4FCE-A674-DFC25844FEFF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3j:*:*:*:*:*:*",
              "matchCriteriaId": "4F73AA9E-51E9-4FA0-813D-AD05FDC3EF94",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3k:*:*:*:*:*:*",
              "matchCriteriaId": "455DD46E-A071-476D-8914-767485E45F35",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3l:*:*:*:*:*:*",
              "matchCriteriaId": "3A422D04-48DF-4A16-94F8-D5702CC2782D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3m:*:*:*:*:*:*",
              "matchCriteriaId": "806E9219-CDF4-4E62-978E-334E96A94BA6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3n:*:*:*:*:*:*",
              "matchCriteriaId": "34D8B182-4E71-4655-8DD8-743A3EF6DC8B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3o:*:*:*:*:*:*",
              "matchCriteriaId": "8D8F6CC7-6B6D-4079-9E2C-A85C4616FF92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3p:*:*:*:*:*:*",
              "matchCriteriaId": "A814F0AB-4AEB-4139-976F-425A4A9EC67B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3q:*:*:*:*:*:*",
              "matchCriteriaId": "8002080A-D384-4CE4-B9FC-1C6C89BA756C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3r:*:*:*:*:*:*",
              "matchCriteriaId": "0538B0F0-664C-425E-AF90-7F46CAC3D842",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3s:*:*:*:*:*:*",
              "matchCriteriaId": "AB7595CC-5C3A-40AB-B679-AFC12CEC77A1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "CC974CA1-88D3-42E4-BF1F-28870F8171B5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:a:*:*:*:*:*:*",
              "matchCriteriaId": "EFE63984-F69B-4593-9AEC-D179D6D98B08",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:b:*:*:*:*:*:*",
              "matchCriteriaId": "34D1F3B3-8E3F-4E4D-8EE6-2F593663B5CC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:c:*:*:*:*:*:*",
              "matchCriteriaId": "16F3D992-9F48-4604-9AAF-DC2D1CE98BE2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update1:*:*:*:*:*:*",
              "matchCriteriaId": "C745A7E6-4760-48CD-B7C4-1C2C20217F21",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update1a:*:*:*:*:*:*",
              "matchCriteriaId": "A5522514-8ED9-45DB-9036-33FE40D77E7D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update1b:*:*:*:*:*:*",
              "matchCriteriaId": "8C27C660-E917-4944-8B4C-41D9622B76D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update1c:*:*:*:*:*:*",
              "matchCriteriaId": "56CFB469-B3E6-4503-A47C-D18206D4D19A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update1d:*:*:*:*:*:*",
              "matchCriteriaId": "67024A43-9E13-4F4E-B711-731792DA3840",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update1e:*:*:*:*:*:*",
              "matchCriteriaId": "1188E9D6-53AD-40D0-8146-3728D071008D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update2:*:*:*:*:*:*",
              "matchCriteriaId": "604F559F-1775-4F29-996E-9079B99345B6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update2a:*:*:*:*:*:*",
              "matchCriteriaId": "61DC9400-5AEE-49AC-9925-0A96E32BD8C0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update2b:*:*:*:*:*:*",
              "matchCriteriaId": "98C1B77E-AB0E-4E8A-8294-2D3D230CDF9B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update2c:*:*:*:*:*:*",
              "matchCriteriaId": "8EC8BEF1-7908-46C0-841A-834778D1A863",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update2d:*:*:*:*:*:*",
              "matchCriteriaId": "89D5A7F9-3183-4EE7-828C-13BB9169E199",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The\u00a0vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol.\u00a0A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution."
    },
    {
      "lang": "es",
      "value": "vCenter Server contiene una vulnerabilidad de desbordamiento de pila en la implementaci\u00f3n del protocolo DCERPC. Un agente malintencionado con acceso de red al vCenter Server puede desencadenar esta vulnerabilidad enviando un paquete de red especialmente manipulado que podr\u00eda provocar la ejecuci\u00f3n remota de c\u00f3digo."
    }
  ],
  "id": "CVE-2024-38812",
  "lastModified": "2025-10-31T15:57:11.573",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "security@vmware.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-09-17T18:15:03.920",
  "references": [
    {
      "source": "security@vmware.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24968"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38812"
    }
  ],
  "sourceIdentifier": "security@vmware.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-122"
        }
      ],
      "source": "security@vmware.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.