Critical VMware vCenter Vulnerability
NJCCIC Advisory
Original Release Date: 10/27/2023
Summary
VMware disclosed a vulnerability, tracked as CVE-2023-34048, in vCenter Server, the central management hub for vSphere suite that allows users to monitor and manage virtualized infrastructure. The vulnerability, which received a critical CVSS score of 9.8/10, is a partial information disclosure flaw that could allow an unauthenticated threat actor to execute code remotely. Active exploitation of this flaw has not yet been reported publicly.
Recommendations
The NJCCIC recommends administrators of vCenter Server update to the patched version as soon as possible after appropriate testing. Due to the severity of the vulnerability, VMware made updates available to end-of-life versions of vCenter Server 6.7U3, 6.5U3, VCF 3.x, and 8.0U1.
The NJCCIC is a component organization within the New Jersey Office of Homeland Security and Preparedness. We are the State's one-stop-shop for cyber threat analysis, incident reporting, and information sharing and are committed to making New Jersey more resilient to cyber threats by spreading awareness and promoting the adoption of best practices.
View our Privacy Policy here.
View our Site Index here.