VMware vCenter Server Appliance updates address sensitive information disclosure vulnerability in backup and restore functions (CVE-2019-5537, CVE-2019-5538)

3. VMware vCenter Server Appliance sensitive information disclosure vulnerabilities in File-Based Backup and Restore functions (CVE-2019-5537 and CVE-2019-5538)

Sensitive information disclosure vulnerabilities resulting from a lack of certificate validation during the File-Based Backup and Restore operations of VMware vCenter Server Appliance may allow a malicious actor to intercept sensitive data in transit over FTPS and HTTPS (CVE-2019-5537) as well as SCP (CVE-2019-5538). VMware has evaluated the severity of these issues to be in the Moderate severity range with a maximum CVSSv3 base score of 6.8.