by Kastro
Paper/Archive/CVE-2023-34051

CVE-2023-34051

vmware — VMware Aria Operations for Logs contains an authentication bypass vulnerability.

EPSS 48%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 98.9.989 × 2019.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

VMware Aria Operations for Logs contains an authentication bypass vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution.

Affected

ProductAffectedFixed inSource
VMware Aria Operations for LogsVMware Aria Operations for Logs 8.x, VMware Cloud Foundation (VMware Aria Operations for Logs) 5.x 4.x –CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refvmware.com/security/advisories/VMSA-2023-0021.html