CVE-2024-22250

high

Description

Session Hijack vulnerability in Deprecated VMware Enhanced Authentication Plug-in could allow a malicious actor with unprivileged local access to a windows operating system can hijack a privileged EAP session when initiated by a privileged domain user on the same system.

References

References
More

https://www.pentestpartners.com/security-blog/no-fix-krbrelay-vmware-style/

https://www.darkreading.com/application-security/critical-vulnerability-vmware-vsphere-plugin-session-hijacking

https://www.bleepingcomputer.com/news/security/vmware-urges-admins-to-remove-deprecated-vulnerable-auth-plug-in/

https://www.vmware.com/security/advisories/VMSA-2024-0003.html

Details

Source: Mitre, NVD

Published: 2024-02-20

Updated: 2024-08-01

Risk Information

CVSS v2

Base Score: 6

Vector: CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C

Severity: Medium

CVSS v3

Base Score: 7.8

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Severity: High

EPSS

EPSS: 0.00066