CVE-2023-20895

published 2023-06-22

CVE-2023-20895: The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to…

critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger a memory corruption vulnerability which may bypass authentication.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
vmware	vcenter_server	< 7.0	7.0
vmware	vcenter_server	—	—
vmware	vcenter_server	—	—
vmware	vmware_cloud_foundation	>= 4.x < 7.0 U3m, 8.0 U1b	7.0 U3m, 8.0 U1b
vmware	vmware_cloud_foundation	>= 5.x < 7.0 U3m, 8.0 U1b	7.0 U3m, 8.0 U1b
vmware	vmware_vcenter_server	>= 7.0 < 7.0 u3m	7.0 u3m
vmware	vmware_vcenter_server	>= 8.0 < 8.0 U1b	8.0 U1b

CWE-787