VMware Releases Security Updates

Security updates address one Critical vulnerability in VMware Carbon Black App Control and one vulnerability in VMware vRealize Orchestrator rated as Important

Threat ID:: CC-4271
Threat Severity:: Medium
Published:: 22 February 2023 3:10 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Security updates address one Critical vulnerability in VMware Carbon Black App Control and one vulnerability in VMware vRealize Orchestrator rated as Important

Affected platforms

The following platforms are known to be affected:

Versions: 8.7.7 and earlier, 8.8.5 and earlier, 8.9.3 and earlier

VMware Carbon Black App Control

Versions: 8.11.0 and earlier

VMware vRealize Orchestrator

Versions: 8.11.0 and earlier

VMware vRealize Automation (vRA)

Threat details

Introduction

VMware has released security updates to address a Critical vulnerability in Carbon Black App Control and a vulnerability in vRealize Orchestrator rated as Important. CVE-2023-20858 is a critical injection vulnerability in Carbon Black App Control with a CVSSv3 rating of 9.1. A remote attacker with privileged access could exploit this vulnerability to gain access to the underlying operating system.

CVE-2023-20855 is a XML External Entity (XXE) vulnerability in vRealize Orchestrator with a CVSSv3 rating of 8.8. A remote attacker with non-administrative access could exploit this vulnerability to bypass XML parsing restrictions, which could lead to access of sensitive information or privilege escalation.

Remediation advice

Affected organisations are encouraged to review the VMware Security Advisories page and apply any relevant updates.

Remediation steps

Type	Step
Patch	VMware Carbon Black App Control updates address an injection vulnerability \| VMSA-2023-0004 https://www.vmware.com/security/advisories/VMSA-2023-0004.html
Patch	VMware vRealize Orchestrator update addresses an XML External Entity (XXE) vulnerability \| VMSA-2023-0005 https://www.vmware.com/security/advisories/VMSA-2023-0005.html

CVE Vulnerabilities

Status Published

CVE-2023-20858

VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injection vulnerability. A malicious actor with privileged access to the App Control administration console may be able to use specially crafted input allowing access to the underlying server operating system.

Status Published

CVE-2023-20855

VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. A malicious actor, with non-administrative access to vRealize Orchestrator, may be able to use specially crafted input to bypass XML parsing restrictions leading to access to sensitive information or possible escalation of privileges.

Last edited: 22 February 2023 3:11 pm