How severe is CVE-2024-22256?

CVE-2024-22256 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2024-22256 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (34th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-22256?

CVE-2024-22256 affects Vmware Cloud Director. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-22256?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-22256 have an EU (EUVD) identifier?

Yes. CVE-2024-22256 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-19825.

When was CVE-2024-22256 published?

CVE-2024-22256 was published on 2024-03-07 and last updated on 2026-06-17.

CVE-2024-22256

CVE-2024-22256 is a medium-severity vulnerability in Vmware Cloud Director with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 3.x base score 4.3)
EPSS exploit prediction: 0% (34th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-19825
Affected product: Vmware Cloud Director
Published: 2024-03-07
Last modified: 2026-06-17

Description

VMware Cloud Director contains a partial information disclosure vulnerability. A malicious actor can potentially gather information about organization names based on the behavior of the instance.

Frequently asked questions

What is CVE-2024-22256?: VMware Cloud Director contains a partial information disclosure vulnerability. A malicious actor can potentially gather information about organization names based on the behavior of the instance.
How severe is CVE-2024-22256?: CVE-2024-22256 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2024-22256 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (34th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-22256?: CVE-2024-22256 affects Vmware Cloud Director. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-22256?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-22256 have an EU (EUVD) identifier?: Yes. CVE-2024-22256 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-19825.
When was CVE-2024-22256 published?: CVE-2024-22256 was published on 2024-03-07 and last updated on 2026-06-17.

References

https://www.vmware.com/security/advisories/VMSA-2024-0007.html

Affected products (1)

cpe:2.3:a:vmware:cloud_director:*:*:*:*:*:*:*:*

More vulnerabilities in Vmware Cloud Director

CVE-2023-34060 — Critical (CVSS 9.8): VMware Cloud Director Appliance contains an authentication bypass vulnerability in case VMware Cloud Director Appliance…
CVE-2024-22277 — Medium (CVSS 6.4): VMware Cloud Director Availability contains an HTML injection vulnerability. A malicious actor with network access to…

All CVEs affecting Vmware Cloud Director →