Priority MEDIUM 51
An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header.
Nutanix
Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9
Exploited now
Nutanix records in CISA KEVNo Nutanix vulnerabilities are listed in CISA KEV.
Records
2 records
TI-2024-11337 CVE-2024-12223 · GHSA-qc9w-ffg5-hm26
Stored Cross-site Scripting (XSS) in Nutanix Prism Central
Priority MEDIUM 48
Prism Central versions prior to 2024.3.1 are vulnerable to a stored cross-site scripting attack via the Events component, allowing an attacker to hijack a victim user’s session and perform actions in their security conte…