> For the complete documentation index, see [llms.txt](https://docs.ionos.com/cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ionos.com/cloud/~/revisions/bM7yG7XCmGE9IxWqMpBu/security/vulnerability-register/cve-2023-34048.md).

# Advisory on CVE-2023-34048

## VMware vCenter Server out-of-bounds write vulnerability

On October 25, 2023, VMWare disclosed a vulnerability in its [<mark style="color:blue;">vCenter Server Security Issues</mark>](https://docs.vmware.com/en/VMware-vSphere/7.0/rn/vsphere-vcenter-server-70u3o-release-notes/index.html#Resolved%20Issues-Security%20Issues). This vulnerability enables a malicious actor with network access to a vCenter Server to trigger an out-of-bounds write – potentially leading to remote code execution. The CVE ID [<mark style="color:blue;">CVE-2023-34048</mark>](https://nvd.nist.gov/vuln/detail/CVE-2023-34048) is assigned to this vulnerability and has a **Critical** severity with Common Vulnerability Scoring System (CVSS) of **9.8 score**.

## Impacted IONOS Cloud Products

| Product Ranges                                                                         | Product        | Impacted | Mitigated | Patch Status |
| -------------------------------------------------------------------------------------- | -------------- | -------- | --------- | ------------ |
| [<mark style="color:blue;">Private Cloud</mark>](https://cloud.ionos.de/private-cloud) | vCenter Server | Yes      | No        | Not Started  |

## Risk on IONOS Cloud customer environment

IONOS Cloud customers access their Private Cloud’s vCenter server via an IONOS-provided dedicated Virtual Private Network (VPN). Every Private Cloud customer has a dedicated VPN, and another customer of IONOS cannot access the vCenter Server instance of another. This reduces the attack surface from external entities. Therefore, we consider this issue to be **Medium** for our customer environment as the reachability of the attack is not public but restricted.

We do not see any active sign of exploitation of this vulnerability, and no public exploit is known yet.

## What action has IONOS Cloud taken to mitigate the severity?

IONOS Cloud provides VServer over a secure virtual private network, which mitigates the risk of exploitation from external entities. We have already initiated the steps to remediate the vulnerability by upgrading the VMWare vCenter version. IONOS Cloud owns the patching responsibility, and there is no action required from the customer.

IONOS Cloud will start to update all VMware vCenter servers on November 6, 2023.

## What is the customer impact during the upgrade?

During the upgrade, you can restrict access to vCenter for up to 1 hour.

## How can I get help?

If you have further questions or concerns about this vulnerability, contact [<mark style="color:blue;">IONOS Cloud Support</mark>](https://docs.ionos.com/support/general-information/contact-information).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.ionos.com/cloud/~/revisions/bM7yG7XCmGE9IxWqMpBu/security/vulnerability-register/cve-2023-34048.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.