Lucene search

[email protected]CVE-2023-20858

HistoryFeb 22, 2023 - 12:15 a.m.

CVE-2023-20858

2023-02-2200:15:11

CWE-74

[email protected]

web.nvd.nist.gov

vmware

carbon black

app control

injection vulnerability

privileged access

administration console

server operating system

nvd

cve-2023-20858

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.9%

JSON

VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injection vulnerability. A malicious actor with privileged access to the App Control administration console may be able to use specially crafted input allowing access to the underlying server operating system.

Affected configurations

NVD

Node

vmwarecarbon_black_app_controlRange8.7.0–8.7.8

vmwarecarbon_black_app_controlRange8.8.0–8.8.6

vmwarecarbon_black_app_controlRange8.9.0–8.9.4

AND

microsoftwindowsMatch-

CPENameOperatorVersion
vmware:carbon_black_app_controlvmware carbon black app controllt8.7.8
vmware:carbon_black_app_controlvmware carbon black app controllt8.8.6
vmware:carbon_black_app_controlvmware carbon black app controllt8.9.4

CPE	Name	Operator	Version
vmware:carbon_black_app_control	vmware carbon black app control	lt	8.7.8
vmware:carbon_black_app_control	vmware carbon black app control	lt	8.8.6
vmware:carbon_black_app_control	vmware carbon black app control	lt	8.9.4

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "VMware Carbon Black App Control",
    "versions": [
      {
        "version": "VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4",
        "status": "affected"
      }
    ]
  }
]