CVE-2023-34052

Published: Oct 20, 2023Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

VMware Aria Operations for Logs contains a deserialization vulnerability. A malicious actor with non-administrative access to the local system can trigger the deserialization of data which could result in authentication bypass.

Affected (4)

Products: Vmware: Aria Operations For Logs

Vmware

1 product

Aria Operations For Logs

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Vmware Aria Operations For Logs	Version 4.0
Vmware Aria Operations For Logs	Version 5.0
Vmware Aria Operations For Logs	Version 8.10.2
Vmware Aria Operations For Logs	Version 8.12

Related CWEs

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (2)

https://www.vmware.com/security/advisories/VMSA-2023-0021.html

Source: security@vmware.com

PatchVendor Advisory

https://www.vmware.com/security/advisories/VMSA-2023-0021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.