Common Weakness Enumeration
CWE-556
AllowedASP.NET Misconfiguration: Use of Identity Impersonation
Abstraction: Variant · Status: Incomplete
Configuring an ASP.NET application to run with impersonated credentials may give the application unnecessary privileges.
1 vulnerability references this CWE, most recent first.
GHSA-RHV4-3CHH-R5JC
Vulnerability from github – Published: 2024-06-18 06:30 – Updated: 2024-07-03 18:45
VLAI
Details
The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2024-37081"
],
"database_specific": {
"cwe_ids": [
"CWE-556"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-18T06:15:11Z",
"severity": "HIGH"
},
"details": "The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo.\u00a0An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance.",
"id": "GHSA-rhv4-3chh-r5jc",
"modified": "2024-07-03T18:45:43Z",
"published": "2024-06-18T06:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37081"
},
{
"type": "WEB",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24453"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Architecture and Design
Use the least privilege principle.
No CAPEC attack patterns related to this CWE.