9.8
Critical
Exploited
CVE-2023-34048 VMware vCenter Server Out-of-Bounds Write Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Ransomware campaigns
Not observed so far
Weakness
CWE-787
Description
vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| VMware vCenter Server 8.0 | earliest → < 8.0U2 | 8.0U2 |
| VMware vCenter Server 7.0 | earliest → < 7.0U3o | 7.0U3o |
| VMware Cloud Foundation (VMware vCenter Server) | 5.x | No fix stated |
| VMware Cloud Foundation (VMware vCenter Server) | 4.x | No fix stated |
| vcenter_server 8.0 | earliest → < 8.0U2 | 8.0U2 |
| cloud_foundation 5.0 | 5.0 → latest | No fix stated |
References
- www.vmware.com www.vmware.com
Timeline
- Published
- Added to the KEV catalogue
- Last modified
Other CVEs of VMware vCenter Server
The 4 CVEs of VMware vCenter Server →
CVE-2023-34056
vCenter Server contains a partial information disclosure vulnerability. A malicious actor with non-administrative…
4.3
Medium
CVE-2019-5531
VMware vSphere ESXi (6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to…
Not rated
CVE-2017-4919
VMware vCenter Server 5.5, 6.0, 6.5 allows vSphere users with certain, limited vSphere privileges to use the VIX API…
Not rated