Severity
High
Analysis Summary
CVE-2023-34056 CVSS:4.3
VMware vCenter Server and Cloud Foundation could allow a remote authenticated attacker to obtain sensitive information, caused by improper authorization validation. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.
CVE-2023-34048 CVSS:9.8
VMware vCenter Server and Cloud Foundation could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds write flaw. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
Impact
- Code Execution
- Information Disclosure
Indicators Of Compromise
CVE
- CVE-2023-34056
- CVE-2023-34048
Affected Vendors
VMware
Affected Products
- VMware vCenter Server 7.0
- VMware vCenter Server 8.0
- VMware Cloud Foundation (vCenter Server) 4.0
- VMware Cloud Foundation (vCenter Server) 5.0
Remediation
Refer to VMware Security Advisory for patch, upgrade or suggested workaround information.