by Kastro
Paper/Archive/CVE-2023-34063

CVE-2023-34063

vmware — Aria Automation contains a Missing Access Control vulnerability.

EPSS 0.9%CVSS 9.9
critical.is priorityof 100
42
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 61.2.612 × 2012.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Aria Automation contains a Missing Access Control vulnerability. An authenticated malicious actor may exploit this vulnerability leading to unauthorized access to remote organizations and workflows.

Affected

ProductAffectedFixed inSource
VMware Aria Automation, VMware Cloud FoundationAria Automation 8.14.1, Aria Automation 8.14.0, Aria Automation 8.13.1, Aria Automation 8.13.0, Aria Automation 8.12.2, Aria Automation 8.12.1, Aria Automation 8.12.0, Aria Automation 8.11.2, Aria Automation 8.11.1, Aria Automation 8.11.0 –CNA

Scores by source

vmware (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refvmware.com/security/advisories/VMSA-2024-0001.html