Critical Update for VMware Aria Operations for Logs
VMware has released a Critical security update to address two vulnerabilities in VMware Aria Operations for Logs
Summary
VMware has released a Critical security update to address two vulnerabilities in VMware Aria Operations for Logs
Affected platforms
The following platforms are known to be affected:
Threat details
Introduction
VMware has released a security update to address two new vulnerabilities in VMware Aria Operations for Logs, including one Critical and one High severity vulnerability.
The Critical vulnerability CVE-2023-20864, has a CVSSv3 score of 9.8 and is related to a deserialisation vulnerability. An unauthenticated, attacker with network access to VMware Aria Operations for Logs could be able to execute arbitrary code as root.
The High vulnerability CVE-2023-20865, has a CVSSv3 score of 7.2 and is related to a command injection vulnerability. An attacker with administrative privileges in VMware Aria Operations for Logs could execute arbitrary commands as root.
Proof-of-Concept exploit code published for CVE-2023-20864
VMware updated VMSA-2023-0007 confirming that proof-of-concept exploit code for CVE-2023-20864 has been published. Exploitation is considered more likely and could lead to executing arbitrary code as root.
Threat updates
| Date | Update |
|---|---|
| 13 Jul 2023 |
Proof-of-Concept exploit code published for CVE-2023-20864
VMware updated VMSA-2023-0007 confirming that proof-of-concept exploit code for CVE-2023-20864 has been published. |
Remediation advice
Affected organisations are encouraged to review VMware's security advisory VMSA-2023-0007 and apply the relevant updates.
Definitive source of threat updates
CVE Vulnerabilities
Last edited: 13 July 2023 11:57 am