Information disclosure in vCenter Server Appliance - CVE-2019-5538
Published: October 30, 2019 / Updated: October 31, 2019
Vulnerability identifier: #VU22423
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-5538
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a lack of certificate validation during the File-Based Backup and Restore operations. A remote attacker with man-in-the-middle positioning between vCenter Server Appliance and a backup target can intercept sensitive data in transit over SCP and gain unauthorized access to sensitive information on the system.
Affected software
vCenter Server Appliance
VCF over VxRail
Dell EMC VxRail Appliance
VCF over VxRail
Dell EMC VxRail Appliance
How to mitigate CVE-2019-5538
Install updates from vendor's website.
vCenter Server Appliance - addressed in versions 6.5u3d, 6.7u3a
VCF over VxRail - update to 3.9.1
Dell EMC VxRail Appliance - addressed in versions 4.5.401, 4.7.301
VCF over VxRail - update to 3.9.1
Dell EMC VxRail Appliance - addressed in versions 4.5.401, 4.7.301