VMware vCenter Server Appliance (vCSA) 5.5 before Update 2, 5.1 before Update 3, and 5.0…
Priority LOW 21CWE-310Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- —
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
VMware vCenter Server Appliance (vCSA) 5.5 before Update 2, 5.1 before Update 3, and 5.0 before Update 3c does not properly validate certificates when connecting to a CIM Server on an ESXi host, which allows man-in-the-middle attackers to spoof CIM servers via a crafted certificate.
Why it matters now
EPSS 0.00589 48th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:vcenter_server_appliance:5.0:update_1:*:*:*:*:*:* | 5.0 update_1 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server_appliance:5.0:update_2:*:*:*:*:*:* | 5.0 update_2 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server_appliance:5.0:update_3:*:*:*:*:*:* | 5.0 update_3 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server_appliance:5.0:update_3a:*:*:*:*:*:* | 5.0 update_3a | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server_appliance:5.1:*:*:*:*:*:*:* | 5.1 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server_appliance:5.1:update_1:*:*:*:*:*:* | 5.1 update_1 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server_appliance:5.1:update_2:*:*:*:*:*:* | 5.1 update_2 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server_appliance:5.5:*:*:*:*:*:*:* | 5.5 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server_appliance:5.5:update_1:*:*:*:*:*:* | 5.5 update_1 | Vulnerable | VMware |
- cpe:2.3:a:vmware:vcenter_server_appliance:5.0:update_1:*:*:*:*:*:* Versions 5.0 update_1 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server_appliance:5.0:update_2:*:*:*:*:*:* Versions 5.0 update_2 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server_appliance:5.0:update_3:*:*:*:*:*:* Versions 5.0 update_3 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server_appliance:5.0:update_3a:*:*:*:*:*:* Versions 5.0 update_3a Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server_appliance:5.1:*:*:*:*:*:*:* Versions 5.1 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server_appliance:5.1:update_1:*:*:*:*:*:* Versions 5.1 update_1 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server_appliance:5.1:update_2:*:*:*:*:*:* Versions 5.1 update_2 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server_appliance:5.5:*:*:*:*:*:*:* Versions 5.5 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server_appliance:5.5:update_1:*:*:*:*:*:* Versions 5.5 update_1 Vulnerable ·VMware
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2014-8371
- 2026-10-03 Alias added: GHSA-m8c3-2mv9-fqpf
References
More VMware Vcenter Server Appliance vulnerabilities
- TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
- TI-2013-02690 VMware vCenter Server Appliance (vCSA) 5.1 before Update 1 allows remote authenticated… CVSS 2.0HIGH 9.0
- TI-2014-03073 Ruby vSphere Console (RVC) in VMware vCenter Server Appliance allows remote authenticated… CVSS 2.0HIGH 9.0
- TI-2013-02689 VMware vCenter Server Appliance (vCSA) 5.1 before Update 1 allows remote authenticated… CVSS 2.0HIGH 9.0
- TI-2013-01458 VMware vCenter Server 4.0 before Update 4b, 5.0 before Update 2, and 5.1 before 5.1.0b… CVSS 2.0HIGH 7.6
Sources
- CVE-2014-8371 · CVE Program
- CVE-2014-8371 · NVD
- FIRST EPSS
- GHSA-m8c3-2mv9-fqpf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences