CVE-2024-22250

Summary

Session Hijack vulnerability in Deprecated VMware Enhanced Authentication Plug-in could allow a malicious actor with unprivileged local access to a windows operating system can hijack a privileged EAP session when initiated by a privileged domain user on the same system.

Affected Software

VendorProductVersion RangeStatus
VMwareVMware Enhanced Authentication Plug-in (EAP)Allaffected

Weaknesses

  • CWE-384: CWE-384 Session Fixation

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References