VMware Enhanced Authentication Plugin vulnerabilities

2 CVEs affecting VMware Enhanced Authentication Plugin, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-22250, published 2024-02-20.

More from VMware.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-22245, published 2024-02-20. Critical severity, CVSS 9.6. EPSS: 1.3% chance of exploitation in the next 30 days. Arbitrary Authentication Relay and Session Hijack vulnerabilities in the deprecated VMware Enhanced Authentication Plug-in (EAP) could allow a malicious actor that could trick a target domain user…
• CVE-2024-22250, published 2024-02-20. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Session Hijack vulnerability in Deprecated VMware Enhanced Authentication Plug-in could allow a malicious actor with unprivileged local access to a windows operating system can hijack a privileged…