VMware · Aria Operations for Networks
CVE-2023-20887
Vmware Aria Operations for Networks Command Injection Vulnerability
O que é
Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.
CISA: VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack resulting in remote code execution.
O que fazer
Apply updates per vendor instructions.
Prazo para as agências federais dos EUA: 13 de julho de 2023
Mais falhas exploradas de VMware
| Adicionado | Vulnerabilidade | Produto | Gravidade | Chance de ataque |
|---|---|---|---|---|
| 4 de mar. de 2025 | TOCTOU Race Condition | ESXi and Workstation | Crítica 9,3 | 1,6% |
| 4 de mar. de 2025 | Arbitrary Write | ESXi | Alto 8,2 | 1,0% |
| 4 de mar. de 2025 | Information Disclosure | ESXi, Workstation, and Fusion | Alto 7,1 | 1,6% |
| 20 de nov. de 2024 | Heap-Based Buffer Overflow | vCenter Server | Crítica 9,8 | 55% |
| 20 de nov. de 2024 | Privilege Escalation | vCenter Server | Alto 7,5 | 17% |
| 30 de jul. de 2024 | Authentication Bypass | ESXi | Média 6,8 | 27% |
| 17 de jul. de 2024 | Incorrect Default File Permissions Vulnerability | vCenter Server | Média 6,5 | 13% |
| 22 de jan. de 2024 | Out-of-Bounds Write | vCenter Server | Crítica 9,8 | 99,2% |
Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.