Description
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| cloud_foundation | vmware / cloud_foundation | >= 4.0, < 5.0 | affected |
| cloud_foundation | vmware / cloud_foundation | >= 5.0, < 5.2 | affected |
| esxi | vmware / esxi | 7.0 | affected |
| esxi | vmware / esxi | >= 8.0, < ESXi80U3-24022510 | affected |
| VMware Cloud Foundation | n/a / VMware Cloud Foundation | 4.x | affected |
| VMware Cloud Foundation | n/a / VMware Cloud Foundation | 5.x | affected |
| VMware ESXi | n/a / VMware ESXi | 7.0 | affected |
| VMware ESXi | n/a / VMware ESXi | >= 8.0, < ESXi80U3-24022510 | affected |