CVE-2024-38815

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

VMware NSX contains a content spoofing vulnerability.

An unauthenticated malicious actor may be able to craft a URL and redirect a victim to an attacker controlled domain leading to sensitive information disclosure.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	VMware NSX, VMware Cloud Foundation	VMware NSX 4.x, VMware Cloud Foundation 5.x
vmware	nsx	>= 4.1.0, < 4.2.1
vmware	nsx-t	>= 3.2.0, < 3.2.4.1
vmware	cloud_foundation	>= 5.0, < Async_Patch_to_4.2.1

References

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25047

Timeline

Published: Oct 9, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-388167.5Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks CVE-2024-388176.7VMware NSX contains a command injection vulnerability. A malicious actor with access to the NSX Edge CLI terminal may be able to craft mal CVE-2024-388186.7VMware NSX contains a local privilege escalation vulnerability. An authenticated malicious actor may exploit this vulnerability to obtain CVE-2024-388197.5Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks CVE-2024-38828.8A vulnerability was found in Tenda W30E 1.0.1.25(633). It has been classified as critical. Affected is the function fromRouteStatic of the f CVE-2024-388205.3The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale depe CVE-2024-388219.1Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances. CVE-2024-388222.7Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion.CVE-2024-388232.7Salt's request server is vulnerable to replay attacks when not using a TLS encrypted transport.CVE-2024-388247.5Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory.CVE-2024-388256.4The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated again CVE-2024-388265.3Authenticated users can upload specifically crafted files to leak server resources. This behavior can potentially be used to run a denial of