Read the docs
TI-2019-03939 Aliases CVE-2019-5534GHSA-7cjg-pprv-8vg9

Information disclosure in VMware vCenter Server

Priority LOW 37CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information disclosure vulnerability where Virtual Machines deployed from an OVF could expose login information via the virtual machine's vAppConfig properties. A malicious actor with access to query the vAppConfig properties of a virtual machine deployed from an OVF may be able to view the credentials used to deploy the OVF (typically the root account of the virtual machine).

Why it matters now

EPSS 0.01627 76th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
VMwarevCenter Server6.7 prior to 6.7 U3; 6.5 prior to 6.5 U3; 6.0 prior to 6.0 U3j—No fix listedCNA
  • vCenter Server VendorVMware Affected 6.7 prior to 6.7 U3; 6.5 prior to 6.5 U3; 6.0 prior to 6.0 U3j Fixed in — No fix listed CNA

CPE configurations NVD · 44

CPEVersionsRoleVendor
cpe:2.3:a:vmware:vcenter_server:6.0:*:*:*:*:*:*:*6.0VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.0:a:*:*:*:*:*:*6.0 aVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.0:b:*:*:*:*:*:*6.0 bVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.0:u1:*:*:*:*:*:*6.0 u1VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.0:u1b:*:*:*:*:*:*6.0 u1bVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.0:u3:*:*:*:*:*:*6.0 u3VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.0:update2:*:*:*:*:*:*6.0 update2VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.0:update2a:*:*:*:*:*:*6.0 update2aVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.0:update2m:*:*:*:*:*:*6.0 update2mVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.0:update3a:*:*:*:*:*:*6.0 update3aVulnerableVMware
  • cpe:2.3:a:vmware:vcenter_server:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.0:a:*:*:*:*:*:* Versions 6.0 a Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.0:b:*:*:*:*:*:* Versions 6.0 b Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.0:u1:*:*:*:*:*:* Versions 6.0 u1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.0:u1b:*:*:*:*:*:* Versions 6.0 u1b Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.0:u3:*:*:*:*:*:* Versions 6.0 u3 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.0:update2:*:*:*:*:*:* Versions 6.0 update2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.0:update2a:*:*:*:*:*:* Versions 6.0 update2a Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.0:update2m:*:*:*:*:*:* Versions 6.0 update2m Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.0:update3a:*:*:*:*:*:* Versions 6.0 update3a Vulnerable ·VMware
Show 34 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:vmware:vcenter_server:6.0:update3b:*:*:*:*:*:*6.0 update3bVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.0:update3c:*:*:*:*:*:*6.0 update3cVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.0:update3d:*:*:*:*:*:*6.0 update3dVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.0:update3e:*:*:*:*:*:*6.0 update3eVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.0:update3f:*:*:*:*:*:*6.0 update3fVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.0:update3g:*:*:*:*:*:*6.0 update3gVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.0:update3h:*:*:*:*:*:*6.0 update3hVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.0:update3i:*:*:*:*:*:*6.0 update3iVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:*:*:*:*:*:*:*6.7VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:a:*:*:*:*:*:*6.7 aVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:b:*:*:*:*:*:*6.7 bVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:c:*:*:*:*:*:*6.7 cVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:d:*:*:*:*:*:*6.7 dVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update1:*:*:*:*:*:*6.7 update1VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update1b:*:*:*:*:*:*6.7 update1bVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update2:*:*:*:*:*:*6.7 update2VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update2a:*:*:*:*:*:*6.7 update2aVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.7:update2c:*:*:*:*:*:*6.7 update2cVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:*:*:*:*:*:*:*6.5VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:a:*:*:*:*:*:*6.5 aVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:b:*:*:*:*:*:*6.5 bVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:c:*:*:*:*:*:*6.5 cVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:d:*:*:*:*:*:*6.5 dVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update1:*:*:*:*:*:*6.5 update1VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update1b:*:*:*:*:*:*6.5 update1bVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update1c:*:*:*:*:*:*6.5 update1cVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update1d:*:*:*:*:*:*6.5 update1dVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update1e:*:*:*:*:*:*6.5 update1eVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update1g:*:*:*:*:*:*6.5 update1gVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update2:*:*:*:*:*:*6.5 update2VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update2b:*:*:*:*:*:*6.5 update2bVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update2c:*:*:*:*:*:*6.5 update2cVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update2d:*:*:*:*:*:*6.5 update2dVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:6.5:update2g:*:*:*:*:*:*6.5 update2gVulnerableVMware
  • cpe:2.3:a:vmware:vcenter_server:6.0:update3b:*:*:*:*:*:* Versions 6.0 update3b Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.0:update3c:*:*:*:*:*:* Versions 6.0 update3c Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.0:update3d:*:*:*:*:*:* Versions 6.0 update3d Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.0:update3e:*:*:*:*:*:* Versions 6.0 update3e Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.0:update3f:*:*:*:*:*:* Versions 6.0 update3f Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.0:update3g:*:*:*:*:*:* Versions 6.0 update3g Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.0:update3h:*:*:*:*:*:* Versions 6.0 update3h Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.0:update3i:*:*:*:*:*:* Versions 6.0 update3i Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:*:*:*:*:*:*:* Versions 6.7 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:a:*:*:*:*:*:* Versions 6.7 a Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:b:*:*:*:*:*:* Versions 6.7 b Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:c:*:*:*:*:*:* Versions 6.7 c Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:d:*:*:*:*:*:* Versions 6.7 d Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update1:*:*:*:*:*:* Versions 6.7 update1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update1b:*:*:*:*:*:* Versions 6.7 update1b Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update2:*:*:*:*:*:* Versions 6.7 update2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update2a:*:*:*:*:*:* Versions 6.7 update2a Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:update2c:*:*:*:*:*:* Versions 6.7 update2c Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:*:*:*:*:*:*:* Versions 6.5 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:a:*:*:*:*:*:* Versions 6.5 a Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:b:*:*:*:*:*:* Versions 6.5 b Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:c:*:*:*:*:*:* Versions 6.5 c Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:d:*:*:*:*:*:* Versions 6.5 d Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update1:*:*:*:*:*:* Versions 6.5 update1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update1b:*:*:*:*:*:* Versions 6.5 update1b Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update1c:*:*:*:*:*:* Versions 6.5 update1c Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update1d:*:*:*:*:*:* Versions 6.5 update1d Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update1e:*:*:*:*:*:* Versions 6.5 update1e Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update1g:*:*:*:*:*:* Versions 6.5 update1g Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update2:*:*:*:*:*:* Versions 6.5 update2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update2b:*:*:*:*:*:* Versions 6.5 update2b Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update2c:*:*:*:*:*:* Versions 6.5 update2c Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update2d:*:*:*:*:*:* Versions 6.5 update2d Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:6.5:update2g:*:*:*:*:*:* Versions 6.5 update2g Vulnerable ·VMware

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-5534
  2. 2026-10-03 Alias added: GHSA-7cjg-pprv-8vg9

References

Advisory 2

  • TI-2026-42442 vCenter directory-traversal vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26040 Privilege escalation in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26039 Heap-overflow in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-24610 Out-of-bounds write in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-16914 VMware vCenter Server Out-of-Bounds Write Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05049 Path traversal in VMware vCenter Server, VMware Cloud Foundation KEVCVSS 3.1CRITICAL 9.8
See all 80 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences