CVE-2023-20896
Severity CVSS v4.0:
Pending analysis
Type:
CWE-125
Out-of-bounds Read
Publication date:
22/06/2023
Last modified:
13/07/2023
Description
The VMware vCenter Server contains an out-of-bounds read vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds read by sending a specially crafted packet leading to denial-of-service of certain services (vmcad, vmdird, and vmafdd).
Impact
Base Score 3.x
7.50
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:vmware:vcenter_server:*:*:*:*:*:*:*:* | 4.0 (including) | 7.0 (excluding) |
| cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:* | ||
| cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:* | ||
| cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:* | ||
| cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:* | ||
| cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:* | ||
| cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:* | ||
| cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:* | ||
| cpe:2.3:a:vmware:vcenter_server:7.0:update1c:*:*:*:*:*:* | ||
| cpe:2.3:a:vmware:vcenter_server:7.0:update1d:*:*:*:*:*:* | ||
| cpe:2.3:a:vmware:vcenter_server:7.0:update2:*:*:*:*:*:* | ||
| cpe:2.3:a:vmware:vcenter_server:7.0:update2a:*:*:*:*:*:* | ||
| cpe:2.3:a:vmware:vcenter_server:7.0:update2b:*:*:*:*:*:* | ||
| cpe:2.3:a:vmware:vcenter_server:7.0:update2c:*:*:*:*:*:* | ||
| cpe:2.3:a:vmware:vcenter_server:7.0:update2d:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page