CVE-2024-37081

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-556

Affected software

Vendor	Product	Versions
n/a	VMware vCenter Server	>= 8.0, < 8.0 U2d; >= 7.0, < 7.0 U3r
n/a	VMware Cloud Foundation	5.x; 4.x
vmware	cloud_foundation	>= 4.0, < 6.0
vmware	vcenter_server	>= 8.0, < 8.0u2d
vmware	vcenter_server	>= 7.0, < 7.0u3r

References

Timeline

Published: Jun 18, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-370829.1When deploying Cloud Foundry together with the haproxy-boshrelease and using a non default configuration, it might be possible to craft HTTP CVE-2024-370848.8In Spring Cloud Data Flow versions prior to 2.11.4, a malicious user who has access to the Skipper server api can use a crafted upload requ CVE-2024-370857.2VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain fu CVE-2024-370866.8VMware ESXi contains an out-of-bounds read vulnerability. A malicious actor with local administrative privileges on a virtual machine with CVE-2024-370875.3The vCenter Server contains a denial-of-service vulnerability. A malicious actor with network access to vCenter Server may create a denial-o CVE-2024-370899.8Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes Consulting Elementor Widgets CVE-2024-370908.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Masterstudy Elementor W CVE-2024-370918.8Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in StylemixThemes Consulting Elementor Wid CVE-2024-370928.8Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes Consulting Elementor Widgets CVE-2024-370938.8Cross-Site Request Forgery (CSRF) vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Cross Site Req CVE-2024-370949.8Missing Authorization vulnerability in StylemixThemes MasterStudy LMS allows Exploiting Incorrectly Configured Access Control Security Level CVE-2024-370954.3Missing Authorization vulnerability in Envira Gallery Team Envira Photo Gallery allows Exploiting Incorrectly Configured Access Control Secu