Unscored severity · published Dec 8, 2014
CVE-2014-8371
VMware vCenter Server Appliance (vCSA) 5.5 before Update 2, 5.1 before Update 3, and 5.0 before Update 3c does not properly validate certificates when connecting to a CIM Server…
–
CVSS
0.6%
EPSS
No
On KEV
Description
VMware vCenter Server Appliance (vCSA) 5.5 before Update 2, 5.1 before Update 3, and 5.0 before Update 3c does not properly validate certificates when connecting to a CIM Server on an ESXi host, which allows man-in-the-middle attackers to spoof CIM servers via a crafted certificate.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VS
Vcenter Server Appliance · Vmware
5.0; 5.0; 5.0; 5.0; 5.1; 5.1; +3 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-8371
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-8371
seclists.org
http://seclists.org/fulldisclosure/2014/Dec/23
www.securityfocus.com
http://www.securityfocus.com/archive/1/534161/100/0/threaded
Vendor Advisory
http://www.vmware.com/security/advisories/VMSA-2014-0012.html
More from Vcenter Server Appliance
–
CVE-2014-3797
Cross-site scripting (XSS) vulnerability in VMware vCenter Server Appliance (vCSA) 5.1 before Update 3 allows remote attackers to inject arbitrary web script or HTML via…
–
CVE-2014-4258
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier and 5.6.17 and earlier allows remote authenticated users to affect confidentiality,…
–
CVE-2014-4241
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0 and 10.3.6.0 allows remote attackers to affect integrity via vectors related…
–
CVE-2014-3790
Ruby vSphere Console (RVC) in VMware vCenter Server Appliance allows remote authenticated users to execute arbitrary commands as root by escaping from a chroot jail
–
CVE-2013-3107
VMware vCenter Server 5.1 before Update 1, when anonymous LDAP binding for Active Directory is enabled, allows remote attackers to bypass authentication by providing a valid…