Vulnerability identifier: #VU86653

Vulnerability risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2024-22245

CWE-ID: CWE-294

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Enhanced Authentication Plug-in (EAP)
Client/Desktop applications / Plugins for browsers, ActiveX components

Vendor: VMware, Inc

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to arbitrary authentication relay issue. A remote attacker trick a target domain user with EAP installed in their web browser into requesting and relaying service tickets for arbitrary Active Directory Service Principal Names (SPNs).

Mitigation
This plugin is no longer supported and will not receive any security updates. It is recommended to remove it from your systems.

Vulnerable software versions

Enhanced Authentication Plug-in (EAP): All versions

---

External links
http://www.vmware.com/security/advisories/VMSA-2024-0003.html
http://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24257

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.