CVE-2023-20892
Severity CVSS v4.0:
Pending analysis
Type:
CWE-787
Out-of-bounds Write
Publication date:
22/06/2023
Last modified:
13/07/2023
Description
The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit heap-overflow vulnerability to execute arbitrary code on the underlying operating system that hosts vCenter Server.
Impact
Base Score 3.x
9.80
Severity 3.x
CRITICAL
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:vmware:vcenter_server:*:*:*:*:*:*:*:* | 7.0 (excluding) | |
| cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:* | ||
| cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:* | ||
| cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:* | ||
| cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:* | ||
| cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:* | ||
| cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:* | ||
| cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:* | ||
| cpe:2.3:a:vmware:vcenter_server:7.0:update1c:*:*:*:*:*:* | ||
| cpe:2.3:a:vmware:vcenter_server:7.0:update1d:*:*:*:*:*:* | ||
| cpe:2.3:a:vmware:vcenter_server:7.0:update2:*:*:*:*:*:* | ||
| cpe:2.3:a:vmware:vcenter_server:7.0:update2a:*:*:*:*:*:* | ||
| cpe:2.3:a:vmware:vcenter_server:7.0:update2b:*:*:*:*:*:* | ||
| cpe:2.3:a:vmware:vcenter_server:7.0:update2c:*:*:*:*:*:* | ||
| cpe:2.3:a:vmware:vcenter_server:7.0:update2d:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page