CVE-2014-8371

Public PoC / Exploit (1)

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

VMware vCenter Server Appliance (vCSA) 5.5 before Update 2, 5.1 before Update 3, and 5.0 before Update 3c does not properly validate certificates when connecting to a CIM Server on an ESXi host, which allows man-in-the-middle attackers to spoof CIM servers via a crafted certificate.

Weaknesses (CWE)

CWE-310

Affected Products (9)

vmware · vcenter_server_appliancevulnerable

References (6)

http://seclists.org/fulldisclosure/2014/Dec/23

http://www.securityfocus.com/archive/1/534161/100/0/threaded

http://www.vmware.com/security/advisories/VMSA-2014-0012.html

Vendor Advisory

http://seclists.org/fulldisclosure/2014/Dec/23

http://www.securityfocus.com/archive/1/534161/100/0/threaded

http://www.vmware.com/security/advisories/VMSA-2014-0012.html

Vendor Advisory