CVE-2014-4632: VMware Vsphere Data Protection

Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days.

VMware vSphere Data Protection (VDP) 5.1, 5.5 before 5.5.9, and 5.8 before 5.8.1 and the proxy client in EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x do not properly verify X.509 certificates from vCenter Server SSL servers, which allows man-in-the-middle attackers to spoof servers, and bypass intended backup and restore access restrictions, via a crafted certificate.

Affected products

• VMware Vsphere Data Protection: version 5.1 only; version 5.5.1 only; version 5.5.6 only; version 5.5.7 only; version 5.5.8 only; version 5.8.0 only

Published 2015-02-01. Last modified 2026-06-17.