PT-2024-6542 · Vmware · Vmware Fusion

Mykola Grymalyuk · Published 2024-06-20 · Updated 2024-09-17 · CVE-2024-38811

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: VMware Fusion versions 13.x before 13.6

Description: The issue is related to insufficient input validation, allowing an attacker to execute arbitrary code in the context of the Fusion application. A malicious actor with standard user privileges may exploit this vulnerability to execute code within Fusion. The root cause is an insecure environment variable.

Recommendations: Update VMware Fusion to version 13.6 on all macOS systems immediately.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2024-07686

CVE-2024-38811

Affected Products

Vmware Fusion

References · 28

• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24939 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-38811 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07686 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-38811 · Security Note
• https://twitter.com/autumn_good_35/status/1830968140848914843 · Twitter Post
• https://t.me/cvenotify/93030 · Telegram Post
• https://twitter.com/jbhall56/status/1831294459843166267 · Twitter Post
• https://twitter.com/fletch_ai/status/1831603251663585380 · Twitter Post
• https://twitter.com/cracbot/status/1832660192766652762 · Twitter Post
• https://t.me/pentestingnews/51021 · Telegram Post
• https://t.me/cvedetector/4673 · Telegram Post
• https://twitter.com/fletch_ai/status/1831603250153275829 · Twitter Post
• https://twitter.com/socradar/status/1831304021761523946 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1830888938493370755 · Twitter Post
• https://t.me/cvenotify/94902 · Telegram Post