VMware Releases Patch for Critical RCE Flaw in Cloud Foundation Platform

VMware on Tuesday transported security updates to tackle a critical security flaw in its VMware Cloud Basis product or service.

Tracked as CVE-2021-39144, the issue has been rated 9.8 out of 10 on the CVSS vulnerability scoring procedure, and relates to a distant code execution vulnerability by using XStream open source library.

“Due to an unauthenticated endpoint that leverages XStream for input serialization in VMware Cloud Basis (NSX-V), a malicious actor can get remote code execution in the context of ‘root’ on the equipment,” the firm claimed in an advisory.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

In mild of the severity of the flaw and its somewhat very low bar for exploitation, the Palo Alto-dependent virtualization companies service provider has also produced available a patch for stop-of-daily life items.

Also addressed by VMware as aspect of the update is CVE-2022-31678 (CVSS score: 5.3), an XML External Entity (XXE) vulnerability that could be exploited to consequence in a denial-of-provider (DoS) affliction or unauthorized facts disclosure.

Security scientists Sina Kheirkhah and Steven Seeley of Source Incite have been credited with reporting both flaws.

Customers of VMware Cloud Basis are encouraged to apply the patches to mitigate prospective threats.

Found this write-up attention-grabbing? Observe THN on Fb, Twitter  and LinkedIn to study much more unique information we submit.