Main Vulnerability Database Vulnerabilities #VU76055

Deserialization of Untrusted Data in Cloud Foundation and VMware Aria Operations (formerly vRealize Operations) - CVE-2023-20878

Published: May 12, 2023

Vulnerability identifier: #VU76055

CSH Severity: Low

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-20878

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data. A remote administrator can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

Cloud Foundation
VMware Aria Operations (formerly vRealize Operations)

How to mitigate CVE-2023-20878

Install updates from vendor's website.

VMware Aria Operations (formerly vRealize Operations) - addressed in versions 8.6.10, 8.10.4

External References

https://www.vmware.com/security/advisories/VMSA-2023-0009.html

Related Security Bulletins