open-vm-tools: authentication bypass vulnerability in the vgauth module

🗓️ 29 Jun 2023 15:15:04Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 4 Views

open-vm-tools vgauth authentication bypass allows root access to compromise confidentiality.

Reporter	Title	Published	Views	Family All 154
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Storage Defender – Data Protect	30 Aug 202317:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DataPower Gateway Virtual Edition vulnerable to security bypass due to open-vm-tools (CVE-2023-20867)	29 Jul 202421:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM includes components with known vulnerabilities	24 Oct 202319:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DataPower Gateway Virtual Edition affected by bypass vulnerability in Open VM Tools	14 May 202415:03	–	ibm
ATTACKERKB	CVE-2023-20867	13 Jun 202300:00	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : open-vm-tools, open-vm-tools-desktop, open-vm-tools-devel (ALAS2023-2023-259)	20 Jul 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2 : open-vm-tools (ALAS-2023-2139)	20 Jul 202300:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0076: open-vm-tools (ALINUX3-SA-2023:0076)	14 May 202500:00	–	nessus
Tenable Nessus	CentOS 9 : open-vm-tools-12.2.0-3.el9	29 Feb 202400:00	–	nessus
Tenable Nessus	CentOS 7 : open-vm-tools (RHSA-2023:3944)	28 Jul 202300:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	7	x86_64	open-vm-tools	0:11.0.5-3.el7_9.6	open-vm-tools-0:11.0.5-3.el7_9.6.x86_64.rpm
Red Hat Enterprise Linux	7	x86_64	open-vm-tools-debuginfo	0:11.0.5-3.el7_9.6	open-vm-tools-debuginfo-0:11.0.5-3.el7_9.6.x86_64.rpm
Red Hat Enterprise Linux	7	x86_64	open-vm-tools-desktop	0:11.0.5-3.el7_9.6	open-vm-tools-desktop-0:11.0.5-3.el7_9.6.x86_64.rpm
Red Hat Enterprise Linux	7	x86_64	open-vm-tools-devel	0:11.0.5-3.el7_9.6	open-vm-tools-devel-0:11.0.5-3.el7_9.6.x86_64.rpm
Red Hat Enterprise Linux	7	x86_64	open-vm-tools-test	0:11.0.5-3.el7_9.6	open-vm-tools-test-0:11.0.5-3.el7_9.6.x86_64.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2023-20867
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-20867
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
cve	www.cve.org/CVERecord
vmware	www.vmware.com/security/advisories/VMSA-2023-0013.html

25 Jun 2026 11:02Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.13.9

EPSS0.13638

SSVC

open-vm-tools vgauth authentication bypass root access vmware esxi security impact