PT-2023-6177 · Netapp · Snapcenter Plugin For Vmware Vsphere

Oded Weissman · Publicado 2023-02-28 · Atualizado 2023-10-18 · CVE-2023-27312

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SnapCenter Plugin for VMware vSphere versions 4.6 through 4.8

Description The issue is related to insufficient access control in the SnapCenter Plugin for VMware vSphere, which may allow authenticated unprivileged users to modify email and snapshot name settings within the VMware vSphere user interface.

Recommendations For versions 4.6 through 4.8, update to version 4.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the email and snapshot name settings within the VMware vSphere user interface until a patch is available.

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-250

CWE-264

CWE-269

Identificadores relacionados

BDU:2023-06886

CVE-2023-27312

Produtos afetados

Snapcenter Plugin For Vmware Vsphere

Referências · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-27312 · Nota de Segurança
• https://twitter.com/CVEnew/status/1712538494306766957 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-27312 · Aviso do Fabricante
• https://t.me/cibsecurity/72197 · Publicação no Telegram
• https://security.netapp.com/advisory/ntap-20230713-0001 · Aviso do Fabricante
• https://vuldb.com/ru/?id.242087 · Nota
• https://bdu.fstec.ru/vul/2023-06886 · Nota de Segurança
• https://docs.netapp.com/us-en/sc-plugin-vmware-vsphere · Nota
• https://twitter.com/VulmonFeeds/status/1712566912067010799 · Publicação no Twitter