CVE-2013-3520 describes an arbitrary code execution vulnerability in VMware vCenter Chargeback Manager versions prior to 2.5.1. This flaw stems from improper handling of file uploads, allowing remote, unauthenticated attackers to execute arbitrary code on affected systems. With a CVSS score of 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) and a FAUCET Risk Score of 99/100, this vulnerability is considered highly severe due to its low attack complexity and potential for complete compromise. While not listed on the KEV catalog, a Metasploit module and ExploitDB entry confirm the existence of public exploit code, indicating a high likelihood of exploitation. Despite this, community discussion and media coverage remain minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.5.0CPE matchmatch criteria | cpe:2.3:a:vmware:vcenter_chargeback_manager:*:*:*:*:*:*:*:* | ||
1.5.0CPE matchmatch criteria | cpe:2.3:a:vmware:vcenter_chargeback_manager:1.5.0:*:*:*:*:*:*:* | ||
1.6.0CPE matchmatch criteria | cpe:2.3:a:vmware:vcenter_chargeback_manager:1.6.0:*:*:*:*:*:*:* | ||
1.6.1CPE matchmatch criteria | cpe:2.3:a:vmware:vcenter_chargeback_manager:1.6.1:*:*:*:*:*:*:* | ||
1.6.2CPE matchmatch criteria | cpe:2.3:a:vmware:vcenter_chargeback_manager:1.6.2:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:P/I:P/A:P
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.