PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-34048 VMware CVE debrief

CVE-2023-34048 affects VMware vCenter Server and is described as an out-of-bounds write vulnerability. CISA added it to the Known Exploited Vulnerabilities catalog on 2024-01-22, with remediation due by 2024-02-12, so affected environments should treat it as a priority issue and follow vendor guidance promptly.

Vendor
VMware
Product
vCenter Server
CVSS
CRITICAL 9.8
CISA KEV
Listed
Original CVE published
2024-01-22
Original CVE updated
2024-01-22
Advisory published
2024-01-22
Advisory updated
2024-01-22

Who should care

VMware vCenter Server administrators, virtualization and infrastructure teams, vulnerability management teams, and incident responders.

Technical summary

The supplied corpus identifies CVE-2023-34048 as an out-of-bounds write issue in VMware vCenter Server and places it in CISA’s Known Exploited Vulnerabilities catalog. The source metadata points to VMware’s advisory VMSA-2023-0023 and the NVD record for additional official reference, but no CVSS score or exploit narrative is included in the corpus.

Defensive priority

Urgent

Recommended defensive actions

  • Apply mitigations per VMware’s vendor instructions as soon as possible.
  • If mitigations are unavailable, discontinue use of the product per CISA guidance.
  • Prioritize remediation to meet the CISA KEV due date of 2024-02-12.
  • Verify which VMware vCenter Server instances are in scope for this CVE.
  • Monitor the official CVE, NVD, CISA KEV, and VMware advisory references for updates.

Evidence notes

The supplied source item marks this vulnerability as a CISA KEV entry for VMware vCenter Server, with dateAdded 2024-01-22 and dueDate 2024-02-12. The source metadata explicitly includes the required action to apply vendor mitigations or discontinue use if mitigations are unavailable, and it references VMware advisory VMSA-2023-0023 plus the NVD record. No CVSS score was provided in the supplied corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-34048 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-34048

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-34048 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-34048

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.