CVE-2023-20867 VMware Tools Authentication Bypass Vulnerability

2023-06-1316:47:21

CWE-287

vmware

www.cve.org

vmware

esxi

authentication

bypass

vulnerability

confidentiality

integrity

guest virtual machine

3.9 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

5 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

52.5%

JSON

A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows",
      "Linux"
    ],
    "product": "VMware Tools",
    "vendor": "VMware",
    "versions": [
      {
        "status": "unaffected",
        "version": "12.2.5"
      }
    ]
  }
]