Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-5538: VMware vCenter Server Appliance backup may expose data

CVE-2019-5538 · published 7 years ago

Summary

The backup and restore feature in VMware vCenter Server Appliance (versions before the latest updates) does not verify the identity of the backup destination. This allows an attacker who can position themselves between the server and the backup target to capture the data being transferred. Apply the latest updates to vCenter Server Appliance or enforce trusted network paths to protect the backup traffic.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
vmware	vcenter_server	6.5 6.7 `cpe:2.3:a:vmware:vcenter_server:6.5:-::::::`

Original advisory text

Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore operations of VMware vCenter Server Appliance (6.7 before 6.7u3a and 6.5 before 6.5u3d) may allow a malicious actor to intercept sensitive data in transit over SCP. A malicious actor with man-in-the-middle positioning between vCenter Server Appliance and a backup target may be able to intercept sensitive data in transit during File-Based Backup and Restore operations.

References

https://www.vmware.com/security/advisories/VMSA-2019-0018.html Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

5.9 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-295Improper Certificate Validation

Timeline

Published28 Oct 2019

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2019-5538 · NVD

Track software like this

Free during beta