CVE-2014-8371

Severity

43%

Complexity

86%

Confidentiality

48%

VMware vCenter Server Appliance (vCSA) 5.5 before Update 2, 5.1 before Update 3, and 5.0 before Update 3c does not properly validate certificates when connecting to a CIM Server on an ESXi host, which allows man-in-the-middle attackers to spoof CIM servers via a crafted certificate.

VMware vCenter Server Appliance (vCSA) 5.5 before Update 2, 5.1 before Update 3, and 5.0 before Update 3c does not properly validate certificates when connecting to a CIM Server on an ESXi host, which allows man-in-the-middle attackers to spoof CIM servers via a crafted certificate.

CVSS 2.0 Base Score 4.3. CVSS Attack Vector: network. CVSS Attack Complexity: medium. CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N).

Overview

Type

VMware vCenter Server Appliance (vCSA)

First reported 10 years ago

2014-12-08 11:59:00

Last updated 6 years ago

2018-10-09 19:53:00

Affected Software

VMware vCenter Server Appliance (vCSA) 5.0 Update 1

5.0

VMware vCenter Server Appliance (vCSA) 5.0 Update 2

5.0

VMware vCenter Server Appliance (vCSA) 5.1

5.1

VMware vCenter Server Appliance (vCSA) 5.1 Update 1

5.1

References

20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities

20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities

http://www.vmware.com/security/advisories/VMSA-2014-0012.html

Vendor Advisory

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.