CVE-2023-34063

Published: Jan 16, 2024Modified: Jun 17, 2026

8.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Exploitability: 2.8 / Impact: 5.5

Source: NVD

Description

Aria Automation contains a Missing Access Control vulnerability. An authenticated malicious actor may exploit this vulnerability leading to unauthorized access to remote organizations and workflows.

Affected (12)

Products: Vmware: Aria Automation, Cloud Foundation

Vmware

2 products

Aria Automation

Cloud Foundation

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Vmware Aria Automation	Version 8.11.0
Vmware Aria Automation	Version 8.11.1
Vmware Aria Automation	Version 8.11.2
Vmware Aria Automation	Version 8.12.0
Vmware Aria Automation	Version 8.12.1
Vmware Aria Automation	Version 8.12.2
Vmware Aria Automation	Version 8.13.0
Vmware Aria Automation	Version 8.13.1
Vmware Aria Automation	Version 8.14.0
Vmware Aria Automation	Version 8.14.1
Vmware Cloud Foundation	Version 4.0
Vmware Cloud Foundation	Version 5.0

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (2)

https://www.vmware.com/security/advisories/VMSA-2024-0001.html

Source: security@vmware.com

PatchVendor Advisory

https://www.vmware.com/security/advisories/VMSA-2024-0001.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.