CVE-2013-3520: VMware vCenter Chargeback Manager

High severity, CVSS 7.5. EPSS: 55.6% chance of exploitation in the next 30 days.

VMware vCenter Chargeback Manager (aka CBM) before 2.5.1 does not proper handle uploads, which allows remote attackers to execute arbitrary code via unspecified vectors.

Affected products

• VMware vCenter Chargeback Manager: up to and including 2.5.0; version 1.5.0 only; version 1.6.0 only; version 1.6.1 only; version 1.6.2 only; version 2.0.0 only; …

Published 2013-06-17. Last modified 2026-06-16.