Memory Corruption Vulnerability in VMware vCenter Server
CVE-2023-20895

8.1HIGH

Key Information:

Vendor
Vmware
Status
Vmware Vcenter Server (vcenter Server)
Vmware Cloud Foundation (vcenter Server)
Vendor
CVE Published:
22 June 2023

Summary

The VMware vCenter Server has a significant memory corruption issue related to the handling of the DCERPC protocol. This vulnerability enables a malicious actor with network access to potentially disrupt normal operation, allowing them to bypass authentication mechanisms. If exploited, this could lead to unauthorized access, posing a serious threat to sensitive data and system integrity. It is crucial for users to stay informed about this vulnerability and apply necessary security updates promptly.

Affected Version(s)

VMware Cloud Foundation (vCenter Server) Windows 5.x < 7.0 U3m, 8.0 U1b

VMware Cloud Foundation (vCenter Server) Windows 4.x < 7.0 U3m, 8.0 U1b

VMware vCenter Server (vCenter Server) Windows 8.0 < 8.0 U1b

References

https://www.vmware.com/security/advisories/VMSA-2023-0014...
https://www.talosintelligence.com/vulnerability_reports/T...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.