Lucene search

[email protected]CVE-2023-34048

HistoryOct 25, 2023 - 6:17 p.m.

CVE-2023-34048

2023-10-2518:17:27

CWE-787

[email protected]

web.nvd.nist.gov

253

In Wild

vcenter server

out-of-bounds write

vulnerability

dcerpc protocol

remote code execution

nvd

cve-2023-34048

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.044 Low

EPSS

Percentile

92.4%

JSON

vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.

Affected configurations

NVD

Node

vmwarevcenter_serverRange4.0–5.5

vmwarevcenter_serverMatch7.0-

vmwarevcenter_serverMatch7.0a

vmwarevcenter_serverMatch7.0b

vmwarevcenter_serverMatch7.0c

vmwarevcenter_serverMatch7.0d

vmwarevcenter_serverMatch7.0update1

vmwarevcenter_serverMatch7.0update1a

vmwarevcenter_serverMatch7.0update1c

vmwarevcenter_serverMatch7.0update1d

vmwarevcenter_serverMatch7.0update2

vmwarevcenter_serverMatch7.0update2a

vmwarevcenter_serverMatch7.0update2b

vmwarevcenter_serverMatch7.0update2c

vmwarevcenter_serverMatch7.0update2d

vmwarevcenter_serverMatch7.0update3

vmwarevcenter_serverMatch7.0update3a

vmwarevcenter_serverMatch7.0update3c

vmwarevcenter_serverMatch7.0update3d

vmwarevcenter_serverMatch7.0update3e

vmwarevcenter_serverMatch7.0update3f

vmwarevcenter_serverMatch7.0update3g

vmwarevcenter_serverMatch7.0update3h

vmwarevcenter_serverMatch7.0update3i

vmwarevcenter_serverMatch7.0update3j

vmwarevcenter_serverMatch7.0update3k

vmwarevcenter_serverMatch7.0update3l

vmwarevcenter_serverMatch7.0update3m

vmwarevcenter_serverMatch7.0update3n

vmwarevcenter_serverMatch8.0-

vmwarevcenter_serverMatch8.0a

vmwarevcenter_serverMatch8.0b

vmwarevcenter_serverMatch8.0c

vmwarevcenter_serverMatch8.0update1

vmwarevcenter_serverMatch8.0update1a

vmwarevcenter_serverMatch8.0update1b

vmwarevcenter_serverMatch8.0update1c

CPENameOperatorVersion
vmware:vcenter_servervmware vcenter serverle5.5
vmware:vcenter_servervmware vcenter servereq7.0
vmware:vcenter_servervmware vcenter servereq8.0

CPE	Name	Operator	Version
vmware:vcenter_server	vmware vcenter server	le	5.5
vmware:vcenter_server	vmware vcenter server	eq	7.0
vmware:vcenter_server	vmware vcenter server	eq	8.0

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux"
    ],
    "product": "VMware vCenter Server",
    "vendor": "VMware",
    "versions": [
      {
        "lessThan": "8.0U2",
        "status": "affected",
        "version": "8.0",
        "versionType": "8.0U2"
      },
      {
        "lessThan": "7.0U3o",
        "status": "affected",
        "version": "7.0",
        "versionType": "7.0U3o"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux"
    ],
    "product": "VMware Cloud Foundation (VMware vCenter Server)",
    "vendor": "VMware",
    "versions": [
      {
        "status": "affected",
        "version": "5.x"
      },
      {
        "status": "affected",
        "version": "4.x"
      }
    ]
  }
]