Skip to content
CVE PROGRAM SOURCE RECORD8.1 High

CVE-2023-20892

VMware vCenter Server heap-overflow vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
vmware

Description

The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit heap-overflow vulnerability to execute arbitrary code on the underlying operating system that hosts vCenter Server.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

VMware VMware vCenter Server (vCenter Server)

Default version status: unaffected

  • 8.0 to < 8.0 U1baffected
  • 7.0 to < 7.0 u3maffected

VMware VMware Cloud Foundation (vCenter Server)

Default version status: unaffected

  • 5.x to < 7.0 U3m, 8.0 U1baffected
  • 4.x to < 7.0 U3m, 8.0 U1baffected

References