CyberSec.Space Logo
Back to CVE Browser

CVE-2015-2342

CRITICAL
10.0
CVSS Severity Score
EPSS Score0.1940%
EPSS Percentile30.13th
PublishedOct 12, 2015
Last ModifiedMay 6, 2026

Vulnerability Description

The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration of MBeans, which allows remote attackers to execute arbitrary code via the RMI protocol.

Affected Platforms (CPE)

📦
Vmware

Vcenter Server

= 5.0
📦
Vmware

Vcenter Server

= 5.1
📦
Vmware

Vcenter Server

= 5.5
📦
Vmware

Vcenter Server

= 6.0

References & Advisories

🔗 http://seclists.org/fulldisclosure/2015/Oct/1
🔗 http://www.securityfocus.com/bid/76930
🔗 http://www.securitytracker.com/id/1033720
🔗 http://www.vmware.com/security/advisories/VMSA-2015-0007.html
🔗 http://www.zerodayinitiative.com/advisories/ZDI-15-455
🔗 https://www.7elements.co.uk/resources/technical-advisories/cve-2015-2342-vmware-vcenter-remote-code-execution/
🔗 http://seclists.org/fulldisclosure/2015/Oct/1
🔗 http://www.securityfocus.com/bid/76930

Related Vulnerabilities

CVE-2013-140510.0

VMware vCenter Server 4.0 before Update 4b and 4.1 before Update 3a, VMware VirtualCenter 2.5, VMware vSphere Client 4.0 before Up...

CVE-2021-219729.8

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with netwo...

CVE-2020-39529.8

Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Contro...

CVE-2021-269879.8

Element Plug-in for vCenter Server incorporates SpringBoot Framework. SpringBoot Framework versions prior to 1.3.2 are susceptible...