Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.
Government officials will never ask you to transfer money or disclose bank log-in details over a phone call.

Call the 24/7 ScamShield Helpline at 1799 if you are unsure if something is a scam.

Cyber Security Agency of Singapore
Alerts

High-Severity Vulnerabilities in VMware vCenter Server and Cloud Foundation Products

26 June 2023

VMware has released security updates to address multiple vulnerabilities (CVE-2023-20892, CVE-2023-20893, CVE-2023-20894 and CVE-2023-20895) in their vCenter Server and Cloud Foundation products.

The vulnerabilities are:

  • CVE-2023-20892: A heap overflow vulnerability that could allow attackers with network access to perform arbitrary code execution.

  • CVE-2023-20893: A use-after-free vulnerability that could allow attackers with network access to perform arbitrary code execution.

  • CVE-2023-20894: An out-of-bound write vulnerability that could allow attackers with network access to cause memory corruption via specially crafted packet.

  • CVE-2023-20895: A memory corruption vulnerability that could allow attackers with network access to bypass authentication.

The vulnerabilities affect the following product versions:

  • vCenter Server versions 7.0 and 8.0

  • Cloud Foundation versions 4.x and 5.

Users and administrators of the affected product versions are advised to update to the latest versions immediately.

More information is available here:

https://www.vmware.com/security/advisories/VMSA-2023-0014.html (opens in new tab)

https://www.bleepingcomputer.com/news/security/vmware-fixes-vcenter-server-bugs-allowing-code-execution-auth-bypass/ (opens in new tab)

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20892 (opens in new tab)

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20893 (opens in new tab)

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20894 (opens in new tab)

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20895 (opens in new tab)