CVE-2024-38815

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

VMware NSX contains a content spoofing vulnerability. 

An unauthenticated malicious actor may be able to craft a URL and redirect a victim to an attacker controlled domain leading to sensitive information disclosure.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Oct 9, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-388167.5Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacksCVE-2024-388176.7VMware NSX contains a command injection vulnerability.  A malicious actor with access to the NSX Edge CLI terminal may be able to craft malCVE-2024-388186.7VMware NSX contains a local privilege escalation vulnerability.  An authenticated malicious actor may exploit this vulnerability to obtain CVE-2024-388197.5Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacksCVE-2024-38828.8A vulnerability was found in Tenda W30E 1.0.1.25(633). It has been classified as critical. Affected is the function fromRouteStatic of the fCVE-2024-388205.3The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale depeCVE-2024-388219.1Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances. CVE-2024-388222.7Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion.CVE-2024-388232.7Salt's request server is vulnerable to replay attacks when not using a TLS encrypted transport.CVE-2024-388247.5Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory.CVE-2024-388256.4The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated againCVE-2024-388265.3Authenticated users can upload specifically crafted files to leak server resources. This behavior can potentially be used to run a denial of
CVE-2024-38815: Medium severity, CVSS 4.3 | Vulnix