CVE-2023-34060

VMware Cloud Director 10.5 Authentication Bypass

Severity Score

9.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

VMware Cloud Director Appliance contains an authentication bypass vulnerability in case VMware Cloud Director Appliance was upgraded to 10.5 from
an older version. On an upgraded version of VMware Cloud Director Appliance 10.5, a malicious actor with network access to the appliance can bypass login
restrictions when authenticating on port 22 (ssh) or port 5480 (appliance management console) . This bypass is not present on port 443 (VCD provider
and tenant login). On a new installation of VMware Cloud Director Appliance 10.5, the bypass is not present. VMware Cloud Director Appliance is impacted since it uses an affected version of sssd from the underlying Photon OS. The sssd issue is no longer present in versions of Photon OS that ship with sssd-2.8.1-11 or higher (Photon OS 3) or sssd-2.8.2-9 or higher (Photon OS 4 and 5).

VMware Cloud Director Appliance contiene una vulnerabilidad de omisión de autenticación en caso de que VMware Cloud Director Appliance se haya actualizado a 10.5 desde una versión anterior. En una versión actualizada de VMware Cloud Director Appliance 10.5, un actor malicioso con acceso de red al dispositivo puede eludir las restricciones de inicio de sesión al autenticarse en el puerto 22 (ssh) o el puerto 5480 (consola de administración del dispositivo). Esta omisión no está presente en el puerto 443 (proveedor de VCD e inicio de sesión del inquilino). En una nueva instalación de VMware Cloud Director Appliance 10.5, la omisión no está presente.

VMware Cloud Director version 10.5 suffers from an authentication bypass vulnerability.

*Credits: N/A

CVSS Scores

NISTv3.1 9.8

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2023-05-25 CVE Reserved
2023-11-14 CVE Published
2024-03-18 EPSS Updated
2024-08-02 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-306: Missing Authentication for Critical Function

CAPEC

References (4)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://github.com/vmware/photon/wiki/Security-Update-3.0-687	2023-11-21
https://github.com/vmware/photon/wiki/Security-Update-4.0-512	2023-11-21
https://github.com/vmware/photon/wiki/Security-Update-5.0-143	2023-11-21
https://www.vmware.com/security/advisories/VMSA-2023-0026.html	2023-11-21

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Vmware Search vendor "Vmware"	Cloud Director Search vendor "Vmware" for product "Cloud Director"	< 10.5 Search vendor "Vmware" for product "Cloud Director" and version " < 10.5"	-	Affected	in	Vmware Search vendor "Vmware"	Photon Os Search vendor "Vmware" for product "Photon Os"	-	-	Safe