Input validation error in vCenter Server - CVE-2024-38813

Vulnerability identifier: #VU97447

CSH Severity: Medium

CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-38813

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote authenticated user can send specially crafted packets to the server and execute arbitrary code with root privileges.

vCenter Server
Dell EMC PowerProtect Data Protection
PowerFlex Appliance
PowerFlex rack
IBM Cloud Pak System
Dell EMC VxRail Appliance

Install updates from vendor's website.

vCenter Server - addressed in versions 7.0 U3s, 8.0 U3b
Dell EMC PowerProtect Data Protection - update to 2.7.8
PowerFlex Appliance - update to IC-38.367.01
IBM Cloud Pak System - update to 2.3.4.1 LA0001-Nov24
PowerFlex rack - update to 3.6.7.1
Dell EMC VxRail Appliance - update to 8.0.311

• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24968

• Multiple vulnerabilities in VMware vCenter Server
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in Dell VxRail Appliance
• PowerProtect Data Protection software update for third-party components
• Dell PowerFlex Appliance update for third-party components
• Dell PowerFlex Rack update for third-party components