Summary: VMware has addressed a high-severity SQL-injection vulnerability in its Aria Automation solution, which could allow an authenticated malicious user to perform unauthorized read/write operations in the database.
Threat Actor: N/A
Victim: VMware
Key Point :
- The SQL-injection vulnerability, tracked as CVE-2024-22280, affects VMware Aria Automation version 8.x and Cloud Foundation versions 5.x and 4.x.
- An authenticated malicious user can exploit the flaw by entering specially crafted SQL queries.
- The vulnerability has a CVSSv3 base score of 8.5.
The content: 
Virtualization giant VMware addressed a high-severity SQL-injection vulnerability, tracked as CVE-2024-22280 (CVSSv3 base score of 8.5), in its Aria Automation solution.
VMware Aria Automation (formerly vRealize Automation) is a modern cloud automation platform that simplifies and streamlines the deployment, management, and governance of cloud infrastructure and applications. It provides a unified platform for automating tasks across multiple cloud environments, including VMware Cloud on AWS, VMware Cloud on Azure, and VMware Cloud Foundation.
An authenticated malicious user can exploit the flaw by entering specially crafted SQL queries and perform unauthorised read/write operations in the database.
“An authenticated malicious user could enter specially crafted SQL queries and perform unauthorised read/write operations in the database.” read the advisory.
The vulnerability impacts VMware Aria Automation version 8.x, and Cloud Foundation versions 5.x and 4.x.
VMware acknowledged Alexandre Lavoie and Felix Boulet with the Canadian Centre gouvernemental de cyberdéfense (CGCD) for privately reporting this issue.
The company states that there are no workarounds for this issue.
In January, VMware addressed a critical vulnerability, tracked as CVE-2023-34063 (CVSS score 9.9), that impacted its Aria Automation platform.
The issue is a missing access control vulnerability that can be exploited by an authenticated attacker actor to gain unauthorized access to remote organizations and workflows.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, VMware)
Source: https://securityaffairs.com/165560/security/vmware-aria-automation-critical-sql-injection.html
“An interesting youtube video that may be related to the article above”