VMware vCenter Server up to 6.0 U2/6.5 U2/6.7 U2 Log Credentials insufficiently protected credentials

Summaryinfo

A vulnerability classified as problematic has been found in VMware vCenter Server up to 6.0 U2/6.5 U2/6.7 U2. Affected is an unknown function of the component Log Handler. Performing a manipulation results in insufficiently protected credentials (Credentials). This vulnerability is reported as CVE-2019-5532. The attack is possible to be carried out remotely. No exploit exists. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability, which was classified as problematic, was found in VMware vCenter Server up to 6.0 U2/6.5 U2/6.7 U2 (Server Management Software). This affects some unknown processing of the component Log Handler. The manipulation with an unknown input leads to a insufficiently protected credentials vulnerability (Credentials). CWE is classifying the issue as CWE-522. The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. This is going to have an impact on confidentiality. The summary by CVE is:

VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information disclosure vulnerability due to the logging of credentials in plain-text for virtual machines deployed through OVF. A malicious user with access to the log files containing vCenter OVF-properties of a virtual machine deployed from an OVF may be able to view the credentials used to deploy the OVF (typically the root account of the virtual machine).

The weakness was disclosed 09/18/2019 (Website). It is possible to read the advisory at vmware.com. This vulnerability is uniquely identified as CVE-2019-5532 since 01/07/2019. The exploitability is told to be easy. It is possible to initiate the attack remotely. Required for exploitation is a authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1552 according to MITRE ATT&CK.

Applying the patch 6.0 U3j/6.5 U3/6.7 U3 is able to eliminate this problem.

The entries VDB-141986 and VDB-141988 are pretty similar. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Server Management Software

Vendor

• VMware

Name

• vCenter Server

Version

• 6.0 U2
• 6.5 U2
• 6.7 U2

License

• commercial

Website

• Vendor: https://www.vmware.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion