CVE-2024-22245

—1

CVSS 3.1

9.6 critical

EPSS

1%p68

Published

Feb 20, 2024 (Feb 20, 2024)

Modified

Jun 17, 2026

Description

Arbitrary Authentication Relay and Session Hijack vulnerabilities in the deprecated VMware Enhanced Authentication Plug-in (EAP) could allow a malicious actor that could trick a target domain user with EAP installed in their web browser into requesting and relaying service tickets for arbitrary Active Directory Service Principal Names (SPNs).

Weakness: CWE-287
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.3%)

In the news4 stories

Week in review: 10 cybersecurity startups to watch, admins urged to remove VMware vSphere plugin

Help Net SecurityFeb 25, 00:00 UTC · Feb 25, 2024Ransomware CVE-2024-22245 CVE-2024-22250 CVE-2024-1709+1 CVEs

VMware Alert: Uninstall EAP Now - Critical Flaw Puts Active Directory at Risk

The Hacker NewsFeb 22, 02:28 UTC · Feb 22, 2024Vulnerability CVE-2024-22245 CVE-2024-22250 CVE-2024-21726

Critical flaw found in deprecated VMware EAP. Uninstall it now

Security AffairsFeb 21, 11:37 UTC · Feb 21, 2024Ransomware CVE-2024-22245 CVE-2024-22250

VMware pushes admins to uninstall vulnerable, deprecated vSphere plugin (CVE-2024-22245, CVE-2024-22250)

Help Net SecurityFeb 25, 16:34 UTC · Feb 25, 2024Vulnerability CVE-2024-22245 CVE-2024-222501