Lucene search
Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)ZDI-23-842HistoryJun 08, 2023 - 12:00 a.m.
VMware Aria Operations for Networks exportPDF Code Injection Information Disclosure Vulnerability
2023-06-0800:00:00
Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)
www.zerodayinitiative.com
15
vmware
aria operations
networks
exportpdf
code injection
information disclosure
vulnerability
remote attackers
sensitive information
authentication
flaw
validation
user-supplied string
javascript code
service account
EPSS
0.18
Percentile
96.3%
This vulnerability allows remote attackers to disclose sensitive information on affected installations of VMware Aria Operations for Networks. Authentication is required to exploit this vulnerability. The specific flaw exists within the exportPDF method. The issue results from the lack of proper validation of a user-supplied string before using it to execute JavaScript code. An attacker can leverage this vulnerability to disclose information in the context of the service account.
Related
nuclei
nuclei
prion
prion
Information disclosure
2023-06-07 15:15:00
nvd
nvd
CVE-2023-20889
2023-06-07 15:15:09
cve
cve
CVE-2023-20889
2023-06-07 15:15:09
cvelist
cvelist
CVE-2023-20889
2023-06-07 14:20:14
vmware
vmware
malwarebytes
malwarebytes
VMware patches critical vulnerabilities in Aria Operations for Networks
2023-06-09 04:00:00
nessus
nessus
attackerkb
attackerkb
CVE-2023-20887
2023-06-07 00:00:00
thn
thn
Urgent Security Updates: Cisco and VMware Address Critical Vulnerabilities
2023-06-08 05:18:00