CVE-2023-20900
published 2023-08-31CVE-2023-20900: A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-9…
high7.5CVSS 3.1
AVAACHPRNUINSUCHIHAH
A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | open-vm-tools | < open-vm-tools 2:12.2.0-1+deb12u1 (bookworm) | open-vm-tools 2:12.2.0-1+deb12u1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| paloalto | pan-os | — | — |
| vmware | open-vm-tools | >= 0 < 2:11.2.5-2+deb11u2 | 2:11.2.5-2+deb11u2 |
| vmware | open-vm-tools | >= 0 < 2:12.2.0-1+deb12u1 | 2:12.2.0-1+deb12u1 |
| vmware | open-vm-tools | >= 0 < 2:12.3.0-1 | 2:12.3.0-1 |
| vmware | open-vm-tools | >= 0 < 2:12.3.0-1 | 2:12.3.0-1 |
| vmware | open_vm_tools | >= 10.3.0 < 12.3.0 | 12.3.0 |
| vmware | tools | >= 10.3.0 < 12.3.0 | 12.3.0 |
| vmware | tools | >= 10.3.0 < 10.3.26 | 10.3.26 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
osv7.5HIGH