Risk | High |
Patch available | YES |
Number of vulnerabilities | 2 |
CVE-ID | CVE-2023-34039 CVE-2023-20890 |
CWE-ID | CWE-338 CWE-434 |
Exploitation vector | Network |
Public exploit | Public exploit code for vulnerability #1 is available. |
Vulnerable software Subscribe |
Aria Operations for Networks (formerly vRealize Network Insight) Server applications / Remote management servers, RDP, SSH |
Vendor |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
EUVDB-ID: #VU80108
Risk: High
CVSSv3.1:
CVE-ID: CVE-2023-34039
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to a lack of unique cryptographic key generation. A remote attacker can bypass SSH authentication and gain unauthorized access to the system.
Install updates from vendor's website.
Vulnerable software versionsAria Operations for Networks (formerly vRealize Network Insight): before 6.11
Fixed software versionsCPE2.3 External links
http://www.vmware.com/security/advisories/VMSA-2023-0018.html
http://kb.vmware.com/s/article/94152
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU80109
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2023-20890
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote user to compromise vulnerable system.
The vulnerability exists due to insufficient validation of file during file upload. A remote authenticated user can upload a malicious file and execute it on the server.
MitigationInstall updates from vendor's website.
Vulnerable software versionsAria Operations for Networks (formerly vRealize Network Insight): before 6.11
Fixed software versionsCPE2.3 External links
http://www.vmware.com/security/advisories/VMSA-2023-0018.html
http://kb.vmware.com/s/article/94152
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?