9.8
CVE-2023-20893
- EPSS 1.25%
- Veröffentlicht 22.06.2023 12:15:10
- Zuletzt bearbeitet 21.11.2024 07:41:46
- Erkennungen
LoginThe VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit this issue to execute arbitrary code on the underlying operating system that hosts vCenter Server.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
VMware ≫ vCenter Server Version < 7.0
VMware ≫ vCenter Server Version 7.0 Update -
VMware ≫ vCenter Server Version 7.0 Update a
VMware ≫ vCenter Server Version 7.0 Update b
VMware ≫ vCenter Server Version 7.0 Update c
VMware ≫ vCenter Server Version 7.0 Update d
VMware ≫ vCenter Server Version 7.0 Update update1
VMware ≫ vCenter Server Version 7.0 Update update1a
VMware ≫ vCenter Server Version 7.0 Update update1c
VMware ≫ vCenter Server Version 7.0 Update update1d
VMware ≫ vCenter Server Version 7.0 Update update2
VMware ≫ vCenter Server Version 7.0 Update update2a
VMware ≫ vCenter Server Version 7.0 Update update2b
VMware ≫ vCenter Server Version 7.0 Update update2c
VMware ≫ vCenter Server Version 7.0 Update update2d
VMware ≫ vCenter Server Version 7.0 Update update3
VMware ≫ vCenter Server Version 7.0 Update update3a
VMware ≫ vCenter Server Version 7.0 Update update3c
VMware ≫ vCenter Server Version 7.0 Update update3d
VMware ≫ vCenter Server Version 7.0 Update update3e
VMware ≫ vCenter Server Version 7.0 Update update3f
VMware ≫ vCenter Server Version 7.0 Update update3g
VMware ≫ vCenter Server Version 7.0 Update update3h
VMware ≫ vCenter Server Version 7.0 Update update3i
VMware ≫ vCenter Server Version 7.0 Update update3j
VMware ≫ vCenter Server Version 7.0 Update update3k
VMware ≫ vCenter Server Version 7.0 Update update3l
VMware ≫ vCenter Server Version 8.0 Update -
VMware ≫ vCenter Server Version 8.0 Update a
VMware ≫ vCenter Server Version 8.0 Update b
VMware ≫ vCenter Server Version 8.0 Update c
VMware ≫ vCenter Server Version 8.0 Update update1
VMware ≫ vCenter Server Version 8.0 Update update1a
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.25% | 0.655 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| VMware | 8.1 | 2.2 | 5.9 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
|
CWE-416 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
https://www.vmware.com/security/advisories/VMSA-2023-0014.html
https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1799