Summary
generated automatically from NVD dataVMware vCenter Chargeback Manager (CBM) has a flaw in how it handles XML API requests, tied to improper input validation (CWE-20). A remote attacker could exploit it through unspecified vectors to read arbitrary files or cause a denial of service. The NVD description states the issue affects versions before 2.0.1, and the flaw carries a CVSS v2.0 score of 6.4 (MEDIUM).
NVD description
VMware vCenter Chargeback Manager (aka CBM) before 2.0.1 does not properly handle XML API requests, which allows remote attackers to read arbitrary files or cause a denial of service via unspecified vectors.
EPSS · FIRST.org
1.9%probability of exploitation in the next 30 days
Higher than 79% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.
CVSS v2.0 Score
Information
- Published
- 13 mars 2012
- Updated
- 16 juin 2026
- Status
- Modified
- Source
- cve@mitre.org
Affected products
Weaknesses (CWE)
Similar CVEs
Other vulnerabilities of type CWE-20
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.