Deserialization of Untrusted Data in Aria Operations for Logs (formerly vRealize Log Insight) - CVE-2023-34052
Published: October 20, 2023
Vulnerability identifier: #VU82268
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-34052
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication.
The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can pass specially crafted data to the application, bypass authentication process and execute arbitrary code on the target system.
Affected software
Aria Operations for Logs (formerly vRealize Log Insight)
How to mitigate CVE-2023-34052
Install updates from vendor's website.
Aria Operations for Logs (formerly vRealize Log Insight) - update to 8.14