CVE-2023-20887
CVE-2023-20887
In short
VMware Aria Operations for Networks has a flaw that allows attackers on the network to inject malicious commands and run arbitrary code on the system. This is critical because it can lead to complete system compromise without requiring any special credentials.
Technical detail
CWE-77 command injection vulnerability in VMware Aria Operations for Networks allows an attacker with network access to inject OS commands through unvalidated input, resulting in unauthenticated remote code execution with system-level privileges. The attack requires only network connectivity to the vulnerable service.
Summary generated and translated by AI from the official description.
Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
public PoCs found — 4
githubgithub.com/sinsinology/CVE-2023-20887★ 229githubgithub.com/Malwareman007/CVE-2023-20887★ 8githubgithub.com/miko550/CVE-2023-20887★ 6cve_referencepacketstormsecurity.com/files/173761/VMWare-Aria-Operations-For-Networks-Remote-Command-Execution.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →