CVE-2024-22256

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-03-07 · updated 2026-06-17

Description

VMware Cloud Director contains a partial information disclosure vulnerability. A malicious actor can potentially gather information about organization names based on the behavior of the instance.

Affected products

VMware Cloud Director Appliance (VCD Appliance): from 10.4.0 before 10.5.1.1 — fixed in 10.5.1.1
VMware Cloud Director: VMware Cloud Director 10.5.x, 10.4.x

How to fix

Upgrade to a fixed version: VMware Cloud Director Appliance (VCD Appliance) 10.5.1.1. Check the vendor advisory for mitigations.

References

https://www.vmware.com/security/advisories/VMSA-2024-0007.html
https://www.vmware.com/security/advisories/VMSA-2024-0007.html

Get alerted when CVE-2024-22256 or the next vulnerability affects your stack