Actively exploited in the wild
VMware vCenter Server Privilege Escalation Vulnerability
VMware - vCenter Server · Listed in the CISA KEV since 2024-11-20. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-38813
HighCVSS 7.5KEVSummary
Privilege escalation vulnerability in VMware vCenter Server. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.
Risk Assessment
Gaining root privileges on vCenter Server means full control over the virtualization environment, including all virtual machines and data.
Recommendation
Update vCenter Server to a version containing the fix (per VMware advisory) and restrict network access to the vCenter management interface.
Other vulnerabilities in VMware vCenter Server
See all- CVE-2017-4927High
VMware vCenter Server versions 6.5 prior to 6.5 U1 and 6.0 prior to 6.0 U3c do not correctly handle specially crafted LDAP network packets, which may allow for remote denial of service.
- CVE-2017-4921High
VMware vCenter Server (6.5 prior to 6.5 U1) contains an insecure library loading issue due to the unsafe use of the LD_LIBRARY_PATH variable. Successful exploitation of this vulnerability may allow unprivileged host users to load a shared library, potentially leading to privilege escalation.
- CVE-2016-7459High
VMware vCenter Server versions 5.5 before U3e and 6.0 before U2a allow remote authenticated users to read arbitrary files via a Log Browser, Distributed Switch setup, or Content Library XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- CVE-2015-2342High
The JMX RMI service in VMware vCenter Server in versions 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration of MBeans, allowing remote attackers to execute arbitrary code via the RMI protocol.
- CVE-2023-34048CriticalActively exploited
vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.
- CVE-2021-22005CriticalActively exploited
The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.
- CVE-2021-21985CriticalActively exploited
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
- CVE-2021-21972CriticalActively exploited
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
- CVE-2020-3952CriticalActively exploited
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.
- CVE-2017-4923Critical
VMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure vulnerability. This issue may allow plaintext credentials to be obtained when using the vCenter Server Appliance file-based backup feature.
Original NVD description (English source)
The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.