VMware fixed critical SQL-Injection in Aria Automation product

VMware addressed a critical SQL-Injection vulnerability, tracked as CVE-2024-22280, impacting Aria Automation.

Virtualization giant VMware addressed a high-severity SQL-injection vulnerability, tracked as CVE-2024-22280 (CVSSv3 base score of 8.5), in its Aria Automation solution.

VMware Aria Automation (formerly vRealize Automation) is a modern cloud automation platform that simplifies and streamlines the deployment, management, and governance of cloud infrastructure and applications. It provides a unified platform for automating tasks across multiple cloud environments, including VMware Cloud on AWS, VMware Cloud on Azure, and VMware Cloud Foundation.

An authenticated malicious user can exploit the flaw by entering specially crafted SQL queries and perform unauthorised read/write operations in the database.

“An authenticated malicious user could enter specially crafted SQL queries and perform unauthorised read/write operations in the database.” read the advisory.

The vulnerability impacts VMware Aria Automation version 8.x, and Cloud Foundation versions 5.x and 4.x. 

VMware acknowledged Alexandre Lavoie and Felix Boulet with the Canadian Centre gouvernemental de cyberdéfense (CGCD) for privately reporting this issue.

The company states that there are no workarounds for this issue.

In January, VMware addressed a critical vulnerability, tracked as CVE-2023-34063 (CVSS score 9.9), that impacted its Aria Automation platform.

The issue is a missing access control vulnerability that can be exploited by an authenticated attacker actor to gain unauthorized access to remote organizations and workflows.

Pierluigi Paganini

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

(SecurityAffairs – hacking, VMware)