CVE-2023-20892

published 2023-06-22

CVE-2023-20892: The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol. A malicious…

critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit heap-overflow vulnerability to execute arbitrary code on the underlying operating system that hosts vCenter Server.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
vmware	vcenter_server	< 7.0	7.0
vmware	vcenter_server	—	—
vmware	vcenter_server	—	—
vmware	vmware_cloud_foundation	>= 4.x < 7.0 U3m, 8.0 U1b	7.0 U3m, 8.0 U1b
vmware	vmware_cloud_foundation	>= 5.x < 7.0 U3m, 8.0 U1b	7.0 U3m, 8.0 U1b
vmware	vmware_vcenter_server	>= 7.0 < 7.0 u3m	7.0 u3m
vmware	vmware_vcenter_server	>= 8.0 < 8.0 U1b	8.0 U1b

CWE-787