2022-11-01 16:00:51 +00:00
{
2023-08-31 10:00:33 +00:00
"data_version" : "4.0" ,
2022-11-01 16:00:51 +00:00
"data_type" : "CVE" ,
"data_format" : "MITRE" ,
"CVE_data_meta" : {
"ID" : "CVE-2023-20900" ,
2023-08-31 10:00:33 +00:00
"ASSIGNER" : "security@vmware.com" ,
"STATE" : "PUBLIC"
2022-11-01 16:00:51 +00:00
} ,
"description" : {
"description_data" : [
{
"lang" : "eng" ,
2023-09-06 13:00:33 +00:00
"value" : "A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html \u00a0in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html ."
2023-08-31 10:00:33 +00:00
}
]
} ,
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng" ,
"value" : "SAML Token Signature Bypass vulnerability"
}
]
}
]
} ,
"affects" : {
"vendor" : {
"vendor_data" : [
{
"vendor_name" : "n/a" ,
"product" : {
"product_data" : [
{
"product_name" : "VMware Tools" ,
"version" : {
"version_data" : [
{
"version_affected" : "=" ,
"version_value" : "12.x.x"
} ,
{
"version_affected" : "=" ,
"version_value" : "11.x.x"
} ,
{
"version_affected" : "=" ,
"version_value" : "10.3.x"
} ,
{
"version_affected" : "=" ,
"version_value" : "10.3.x"
}
]
}
} ,
{
"product_name" : "VMware Tools (open-vm-tools)" ,
"version" : {
"version_data" : [
{
"version_affected" : "=" ,
"version_value" : "12.x.x"
} ,
{
"version_affected" : "=" ,
"version_value" : "11.x.x"
} ,
{
"version_affected" : "=" ,
"version_value" : "10.3.x"
}
]
}
}
]
}
}
]
}
} ,
"references" : {
"reference_data" : [
{
"url" : "https://www.vmware.com/security/advisories/VMSA-2023-0019.html" ,
"refsource" : "MISC" ,
"name" : "https://www.vmware.com/security/advisories/VMSA-2023-0019.html"
2023-08-31 15:00:33 +00:00
} ,
{
"url" : "http://www.openwall.com/lists/oss-security/2023/08/31/1" ,
"refsource" : "MISC" ,
"name" : "http://www.openwall.com/lists/oss-security/2023/08/31/1"
2023-09-11 04:00:35 +00:00
} ,
{
"url" : "https://www.debian.org/security/2023/dsa-5493" ,
"refsource" : "MISC" ,
"name" : "https://www.debian.org/security/2023/dsa-5493"
2023-09-14 03:00:34 +00:00
} ,
{
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZJM6HDRQYS74JA7YNKQBFH2XSZ52HEWH/" ,
"refsource" : "MISC" ,
"name" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZJM6HDRQYS74JA7YNKQBFH2XSZ52HEWH/"
2023-09-15 22:00:34 +00:00
} ,
{
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NVKQ6Y2JFJRWPFOZUOTFO3H27BK5GGOG/" ,
"refsource" : "MISC" ,
"name" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NVKQ6Y2JFJRWPFOZUOTFO3H27BK5GGOG/"
2023-09-20 03:00:32 +00:00
} ,
{
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJNJMD67QIT6LXLKWSHFM47DCLRSMT6W/" ,
"refsource" : "MISC" ,
"name" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJNJMD67QIT6LXLKWSHFM47DCLRSMT6W/"
2023-10-01 21:00:33 +00:00
} ,
{
"url" : "https://lists.debian.org/debian-lts-announce/2023/10/msg00000.html" ,
"refsource" : "MISC" ,
"name" : "https://lists.debian.org/debian-lts-announce/2023/10/msg00000.html"
2023-10-13 22:00:37 +00:00
} ,
{
"url" : "https://security.netapp.com/advisory/ntap-20231013-0002/" ,
"refsource" : "MISC" ,
"name" : "https://security.netapp.com/advisory/ntap-20231013-0002/"
2023-10-27 12:00:32 +00:00
} ,
{
"url" : "http://www.openwall.com/lists/oss-security/2023/10/27/1" ,
"refsource" : "MISC" ,
"name" : "http://www.openwall.com/lists/oss-security/2023/10/27/1"
2023-08-31 10:00:33 +00:00
}
]
} ,
"generator" : {
"engine" : "Vulnogram 0.1.0-dev"
} ,
"source" : {
"discovery" : "UNKNOWN"
} ,
"impact" : {
"cvss" : [
{
"attackComplexity" : "HIGH" ,
"attackVector" : "ADJACENT_NETWORK" ,
"availabilityImpact" : "HIGH" ,
2023-11-17 05:00:35 +00:00
"baseScore" : 7.1 ,
2023-08-31 10:00:33 +00:00
"baseSeverity" : "HIGH" ,
"confidentialityImpact" : "HIGH" ,
"integrityImpact" : "HIGH" ,
2023-11-17 05:00:35 +00:00
"privilegesRequired" : "LOW" ,
2023-08-31 10:00:33 +00:00
"scope" : "UNCHANGED" ,
"userInteraction" : "NONE" ,
2023-11-17 05:00:35 +00:00
"vectorString" : "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" ,
2023-08-31 10:00:33 +00:00
"version" : "3.1"
2022-11-01 16:00:51 +00:00
}
]
}
}
