VMWare releases Fusion vulnerability with 8.8 rating
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-38811 | VMware Fusion (13.x before 13.6) contains a code-execution vulnerability due to the usage of an insecure environment variable. VMware Fusion (13.x before 13.6) contains a code-execution vulnerability due to the usage of an insecure environment variable. A malicious actor with standard user privileges may exploit this vulnerability to execute code in the context of the Fusion application. NVD description · AI analysis pending | 7.8 | <1% |
| — |
Full article160 words · extracted from cyberscoop.com · click to collapse
The company issued a patch for the high-severity bug that allows arbitrary code execution.
A critical vulnerability in VMWare Fusion that allows code execution in the program with standard user privileges was released last Wednesday, according to Broadcom.
The security advisory is for version 13.x until 13.6 on the popular virtualization software for macOS. The bug — CVE-2024-38811 — has a CVSSv3 base score of 8.8 and is caused by an insecure environment variable. Mykola Grymalyuk of RIPEDA Consulting reported the vulnerability and VMWare has issued a patched version of the software.
The vulnerability allows a user with standard privileges to execute code within the Fusion application.
Ransomware actors have long used VMWare products for initial access and further digital extortion. The new ransomware variant Cicada3301 is known to use a vulnerability in VMWare ESXi systems.
Text extracted automatically; images, tables and formatting may be missing. Original: https://cyberscoop.com/vmware-vulnerability-fushion-cve-2024-38811/