PT-2023-1450 · Vmware · Vmware Vrealize Orchestrator

Published 2023-02-21 · Updated 2025-03-17 · CVE-2023-20855

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VMware vRealize Orchestrator (affected versions not specified)

Description The issue is related to an XML External Entity (XXE) vulnerability. A malicious actor with non-administrative access to vRealize Orchestrator may be able to use specially crafted input to bypass XML parsing restrictions, leading to access to sensitive information or possible escalation of privileges. The vulnerability is associated with incorrect restriction of XML links to external objects, which can allow a remote attacker to conduct XXE attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2023-00857

CVE-2023-20855

Affected Products

Vmware Vrealize Orchestrator

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-20855 · Security Note
• https://bdu.fstec.ru/vul/2023-00857 · Security Note
• https://osv.dev/vulnerability/CVE-2023-20855 · Vendor Advisory
• https://vmware.com/security/advisories/VMSA-2023-0005.html · Vendor Advisory
• https://t.me/cvenotify/44776 · Telegram Post
• https://t.me/true_secator/4100 · Telegram Post
• https://t.me/cvenotify/115086 · Telegram Post
• https://t.me/cvenotify/45431 · Telegram Post
• https://t.me/cibsecurity/58655 · Telegram Post