CVE-2024-22280

—

CVSS 3.1

8.1 high

EPSS

<1%p39

Published

Jul 11, 2024 (Jul 11, 2024)

Modified

Jun 17, 2026

Description

VMware Aria Automation does not apply correct input validation which allows for SQL-injection in the product. An authenticated malicious user could enter specially crafted SQL queries and perform unauthorised read/write operations in the database.

Vendors: vmware
Products: aria automation, cloud foundation
Weakness: CWE-89
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news2 stories

GitLab Patches Critical Flaw Allowing Unauthorized Pipeline Jobs

The Hacker NewsJul 11, 03:51 UTC · Jul 11, 2024Vulnerability CVE-2024-6385 CVE-2024-5655 CVE-2024-5257+3 CVEs1

VMware fixed critical SQL

Security AffairsJul 11, 00:09 UTC · Jul 11, 2024Vulnerability CVE-2024-22280 CVE-2023-340631