// For flags

CVE-2023-20887

Vmware Aria Operations for Networks Command Injection Vulnerability

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

5
*Multiple Sources

Exploited in Wild

Yes
*KEV

Decision

-
*SSVC
Descriptions

Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.

This vulnerability allows remote attackers to execute arbitrary code on affected installations of VMware Aria Operations for Networks. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the createSupportBundle method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.

VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack resulting in remote code execution.

*Credits: Anonymous
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-11-01 CVE Reserved
  • 2023-06-07 CVE Published
  • 2023-06-07 First Exploit
  • 2023-06-22 Exploited in Wild
  • 2023-07-13 KEV Due Date
  • 2024-08-02 CVE Updated
  • 2024-08-29 EPSS Updated
CWE
  • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Vmware
Search vendor "Vmware"
 Aria Operations For Networks
Search vendor "Vmware" for product "Aria Operations For Networks"
 >= 6.2.0 <= 6.10.0
Search vendor "Vmware" for product "Aria Operations For Networks" and version " >= 6.2.0 <= 6.10.0"
-
Affected