Critical VMware Cloud Director Flaw Lets Hackers Take over Corporate Servers
Citadelo said it was able to perform the following the set of activities by misusing the defect: View content of the internal system database, including passwords hashes of any clients allocated to this infrastructure. windows administration Alter the system database to access outside virtual machines (VM) allocated to various companies within Cloud Director. Raise benefits from "Organization Administrator" to "System Administrator" with access to all cloud accounts by only changing the password by means of a SQL query. Alter the Cloud Director's login page, allowing the attacker to capture passwords of another client in plaintext, including System Administrator accounts. Peruse other sensitive information related to clients, similar to complete names, email locations, or IP addresses. After Citadelo privately uncovered the discoveries to VMware on April 1, the organization fixed the flaws in upgrades spreading over version 9.1.0.4...