PT-2023-6177 · Netapp · Snapcenter Plugin For Vmware Vsphere

Oded Weissman · Published 2023-02-28 · Updated 2023-10-18 · CVE-2023-27312

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SnapCenter Plugin for VMware vSphere versions 4.6 through 4.8

Description The issue is related to insufficient access control in the SnapCenter Plugin for VMware vSphere, which may allow authenticated unprivileged users to modify email and snapshot name settings within the VMware vSphere user interface.

Recommendations For versions 4.6 through 4.8, update to version 4.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the email and snapshot name settings within the VMware vSphere user interface until a patch is available.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-250

CWE-264

CWE-269

Related Identifiers

BDU:2023-06886

CVE-2023-27312

Affected Products

Snapcenter Plugin For Vmware Vsphere

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-27312 · Security Note
• https://osv.dev/vulnerability/CVE-2023-27312 · Vendor Advisory
• https://security.netapp.com/advisory/ntap-20230713-0001 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06886 · Security Note
• https://twitter.com/CVEnew/status/1712538494306766957 · Twitter Post
• https://t.me/cibsecurity/72197 · Telegram Post
• https://vuldb.com/ru/?id.242087 · Note
• https://docs.netapp.com/us-en/sc-plugin-vmware-vsphere · Note
• https://twitter.com/VulmonFeeds/status/1712566912067010799 · Twitter Post