CVE-2023-20867

Published: Jun 13, 2023Modified: Jun 17, 2026CISA KEV

3.9

Vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Exploitability: 0.8 / Impact: 2.7

Source: NVD

Description

A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.

Affected (7)

Products: Vmware: Tools · Debian: Debian Linux · Fedoraproject: Fedora

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Vmware Tools	From 10.3.0 to 12.2.5

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 11.0
Debian Debian Linux	Version 12.0

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 37
Fedoraproject Fedora	Version 38
Fedoraproject Fedora	Version 39

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (19)

http://www.openwall.com/lists/oss-security/2023/10/16/11

Source: security@vmware.com

Mailing ListPatch

http://www.openwall.com/lists/oss-security/2023/10/16/2

Source: security@vmware.com

Mailing ListPatch

https://lists.debian.org/debian-lts-announce/2023/08/msg00020.html

Source: security@vmware.com

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NVKQ6Y2JFJRWPFOZUOTFO3H27BK5GGOG/

Source: security@vmware.com

Mailing ListRelease Notes

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJNJMD67QIT6LXLKWSHFM47DCLRSMT6W/

Source: security@vmware.com

Mailing ListRelease Notes

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZJM6HDRQYS74JA7YNKQBFH2XSZ52HEWH/

Source: security@vmware.com

Mailing ListRelease Notes

https://security.netapp.com/advisory/ntap-20230725-0001/

Source: security@vmware.com

Third Party Advisory

https://www.debian.org/security/2023/dsa-5493

Source: security@vmware.com

Mailing ListThird Party Advisory

https://www.vmware.com/security/advisories/VMSA-2023-0013.html

Source: security@vmware.com

PatchVendor Advisory

http://www.openwall.com/lists/oss-security/2023/10/16/11