PT-2023-2926 · Vmware · Vmware Aria Operations For Logs

Moonback + 1 · Published 2023-04-20 · Updated 2023-07-11 · CVE-2023-20865

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VMware Aria Operations for Logs (affected versions not specified)

Description The issue is related to a command injection vulnerability in VMware Aria Operations for Logs. A malicious actor with administrative privileges can execute arbitrary commands as root. This can be achieved by exploiting the lack of proper neutralization of special elements used in the OS command.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2023-02905

CVE-2023-20865

Affected Products

Vmware Aria Operations For Logs

References · 8

• https://vmware.com/security/advisories/VMSA-2023-0007.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02905 · Security Note
• https://osv.dev/vulnerability/CVE-2023-20865 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-20865 · Security Note
• https://t.me/true_secator/4310 · Telegram Post
• https://t.me/cvenotify/49576 · Telegram Post
• https://t.me/cibsecurity/62556 · Telegram Post
• https://t.me/true_secator/4601 · Telegram Post