VMware vCenter Chargeback Manager vulnerabilities

2 CVEs affecting VMware vCenter Chargeback Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2013-3520, published 2013-06-17.

More from VMware.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2013-3520, published 2013-06-17. High severity, CVSS 7.5. EPSS: 55.6% chance of exploitation in the next 30 days. VMware vCenter Chargeback Manager (aka CBM) before 2.5.1 does not proper handle uploads, which allows remote attackers to execute arbitrary code via unspecified vectors.
• CVE-2012-1472, published 2012-03-13. Medium severity, CVSS 6.4. EPSS: 1.9% chance of exploitation in the next 30 days. VMware vCenter Chargeback Manager (aka CBM) before 2.0.1 does not properly handle XML API requests, which allows remote attackers to read arbitrary files or cause a denial of service via unspecified…