by Kastro
Paper/Archive/CVE-2023-20864

CVE-2023-20864

vmware — VMware Aria Operations for Logs contains a deserialization vulnerability.

EPSS 70%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 99.4.994 × 2019.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

VMware Aria Operations for Logs contains a deserialization vulnerability. An unauthenticated, malicious actor with network access to VMware Aria Operations for Logs may be able to execute arbitrary code as root.

Affected

ProductAffectedFixed inSource
VMware Aria Operations for Logs (formerly vRealize Log Insight)VMware Aria Operations for Logs (formerly vRealize Log Insight) 8.10.2–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refvmware.com/security/advisories/VMSA-2023-0007.html