Use-After-Free Vulnerability in VMware vCenter Server
CVE-2023-20893

8.1HIGH

Key Information:

Vendor
Vmware
Status
Vmware Vcenter Server (vcenter Server)
Vmware Cloud Foundation (vcenter Server)
Vendor
CVE Published:
22 June 2023

Summary

The vCenter Server from VMware is susceptible to a use-after-free vulnerability in its DCERPC protocol implementation. This vulnerability can be exploited by an attacker with network access to the vCenter Server, enabling them to execute arbitrary code on the underlying operating system. Organizations using affected versions should take immediate steps to assess their exposure and apply necessary security updates to mitigate risks.

Affected Version(s)

VMware Cloud Foundation (vCenter Server) Windows 5.x < 7.0 U3m, 8.0 U1b

VMware Cloud Foundation (vCenter Server) Windows 4.x < 7.0 U3m, 8.0 U1b

VMware vCenter Server (vCenter Server) Windows 8.0 < 8.0 U1b

References

https://www.vmware.com/security/advisories/VMSA-2023-0014...
https://www.talosintelligence.com/vulnerability_reports/T...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.