3.9

CVE-2023-20867

Warning

A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.

Data is provided by the National Vulnerability Database (NVD)
VMware ≫ Tools Version >= 10.3.0 < 12.2.5
Debian ≫ Debian Linux Version10.0
Debian ≫ Debian Linux Version11.0
Debian ≫ Debian Linux Version12.0
Fedoraproject ≫ Fedora Version37
Fedoraproject ≫ Fedora Version38
Fedoraproject ≫ Fedora Version39

23.06.2023: CISA Known Exploited Vulnerabilities (KEV) Catalog

VMware Tools Authentication Bypass Vulnerability

Vulnerability

VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access over ESXi to exploit this vulnerability.

Description

Apply updates per vendor instructions.

Required actions
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.98% 0.76
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 3.9 0.8 2.7
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
security@vmware.com 3.9 0.8 2.7
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

https://www.debian.org/security/2023/dsa-5493
Third Party Advisory
Mailing List