CVE-2023-20865

2023-04-2021:15:08

CWE-77

vmware

web.nvd.nist.gov

vmware

aria operations

logs

cve-2023-20865

command injection

vulnerability

nvd

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

48.2%

JSON

VMware Aria Operations for Logs contains a command injection vulnerability. A malicious actor with administrative privileges in VMware Aria Operations for Logs can execute arbitrary commands as root.

Affected configurations

Nvd

Node

vmwarearia_operations_for_logsRange8.6.0–8.12.0

vmwarecloud_foundationRange4.0–4.5

VendorProductVersionCPE
vmwarearia_operations_for_logs*cpe:2.3:a:vmware:aria_operations_for_logs:*:*:*:*:*:*:*:*
vmwarecloud_foundation*cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
vmware	aria_operations_for_logs	*	cpe:2.3:a:vmware:aria_operations_for_logs::::::::
vmware	cloud_foundation	*	cpe:2.3:a:vmware:cloud_foundation::::::::

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "VMware Aria Operations for Logs (formerly vRealize Log Insight)",
    "versions": [
      {
        "version": "VMware Aria Operations for Logs (formerly vRealize Log Insight) prior to 8.12",
        "status": "affected"
      }
    ]
  }
]