PT-2023-2995 · Vmware · Vmware Aria Operations

Bing + 1 · Publicado 2023-05-11 · Atualizado 2023-05-24 · CVE-2023-20880

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Média

Vetor base

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware Aria Operations (affected versions not specified)

Description The issue is related to insufficient access control in the VMware Aria Operations tool, which can be exploited to execute arbitrary code and escalate privileges. A malicious actor with administrative access to the local system can escalate privileges to 'root'.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

CWE-264

Identificadores relacionados

BDU:2023-03023

CVE-2023-20880

Produtos afetados

Vmware Aria Operations

Referências · 7

• https://cybersecurity-help.cz/vdb/SB2023051209 · Nota
• https://vmware.com/security/advisories/VMSA-2023-0009.html · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-03023 · Nota de Segurança
• https://t.me/cibsecurity/64057 · Publicação no Telegram
• https://t.me/cvenotify/50365 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-20880 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-20880 · Nota de Segurança