{"id":"CVE-2024-37081","aliases":["EUVD-2024-36414","GHSA-rhv4-3chh-r5jc"],"status":"published","title":"The vCenter Server contains multiple local privilege escalation vulnerabilities due to...","description":"The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.04989,"percentile":0.92324,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-556"],"published":"2024-06-18T05:43:20Z","modified":"2026-11-03T21:52:37Z","exploits":[{"source":"metasploit","id":"exploit/linux/local/vcenter_sudo_lpe","title":"vCenter Sudo Privilege Escalation","type":"exploit","platform":"Linux","date":"2024-06-18","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/local/vcenter_sudo_lpe"},{"source":"pocgithub","id":"mbadanoiu/CVE-2024-37081","title":"mbadanoiu/CVE-2024-37081","date":"2024-07-06","url":"https://github.com/mbadanoiu/CVE-2024-37081"},{"source":"pocgithub","id":"Mr-r00t11/CVE-2024-37081","title":"Mr-r00t11/CVE-2024-37081","date":"2024-07-09","url":"https://github.com/Mr-r00t11/CVE-2024-37081"},{"source":"pocgithub","id":"CERTologists/Modified-CVE-2024-37081-POC","title":"CERTologists/Modified-CVE-2024-37081-POC","date":"2024-07-21","url":"https://github.com/CERTologists/Modified-CVE-2024-37081-POC"}],"products":[{"vendor":"vmware","product":"cloud_foundation"},{"vendor":"vmware","product":"vcenter_server"},{"vendor":"vmware","product":"vmware cloud foundation"}],"references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24453","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37081"},{"url":"https://github.com/advisories/GHSA-rhv4-3chh-r5jc"}],"sources":{"cve":[{"id":"CVE-2024-37081","description":"The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance.","status":"published","published":"2024-06-18T05:43:20.58Z","modified":"2026-11-04T00:00:08.731Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-556"],"updated_at":"2026-11-04T00:47:47.540303Z"}],"euvd":[{"id":"EUVD-2024-36414","description":"The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance.","status":"published","published":"2024-06-18T05:43:20Z","modified":"2026-11-04T00:00:08Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-04T01:51:27.299093Z"}],"ghsa":[{"id":"GHSA-rhv4-3chh-r5jc","title":"The vCenter Server contains multiple local privilege escalation vulnerabilities due to...","description":"The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance.","status":"published","published":"2024-06-18T06:30:43Z","modified":"2024-07-03T18:45:44Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-556"],"updated_at":"2026-11-02T14:57:37.660934Z"}],"nvd":[{"id":"CVE-2024-37081","description":"The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance.","status":"published","published":"2024-06-18T06:15:11.9Z","modified":"2026-11-03T22:17:20.783Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-556"],"updated_at":"2026-11-04T00:47:54.173626Z"}]}}