CVE-2023-20878

Published: May 12, 2023Modified: Jun 17, 2026

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

VMware Aria Operations contains a deserialization vulnerability. A malicious actor with administrative privileges can execute arbitrary commands and disrupt the system.

Affected (12)

Products: Vmware: Cloud Foundation, Vrealize Operations

Vmware

2 products

Cloud Foundation

Vrealize Operations

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Vmware Cloud Foundation	From 4.0 to 4.5
Vmware Vrealize Operations	Version 8.10.0
Vmware Vrealize Operations	Version 8.10.0 hotfix1
Vmware Vrealize Operations	Version 8.10.0 hotfix2
Vmware Vrealize Operations	Version 8.6.0
Vmware Vrealize Operations	Version 8.6.0 hotfix1
Vmware Vrealize Operations	Version 8.6.0 hotfix2
Vmware Vrealize Operations	Version 8.6.0 hotfix4
Vmware Vrealize Operations	Version 8.6.0 hotfix5
Vmware Vrealize Operations	Version 8.6.0 hotfix6
Vmware Vrealize Operations	Version 8.6.0 hotfix8
Vmware Vrealize Operations	Version 8.6.0 hotfix9

Related CWEs

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (2)

https://www.vmware.com/security/advisories/VMSA-2023-0009.html

Source: security@vmware.com

Vendor Advisory

https://www.vmware.com/security/advisories/VMSA-2023-0009.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.