VMSA-2023-0012

• Aria Operations for Networks (Formerly vRealize Network Insight)

Multiple vulnerabilities in Aria Operations for Networks were privately reported to VMware. Patches are available to remediate these vulnerabilities in affected VMware products.

Aria Operations for Networks contains a command injection vulnerability. VMware has evaluated the severity of this issue to be in the critical severity range with a maximum CVSSv3 base score of 9.8.

A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.

To remediate CVE-2023-20887 apply the updates listed in the ‘Fixed Version’ column of the ‘Response Matrix’ below.

None.

None.

None.

VMware would like to thank Anonymous working with Trend Micro Zero Day Initiative for reporting this issue to us.

Aria Operations for Networks contains an authenticated deserialization vulnerability. VMware has evaluated the severity of this issue to be in the critical severity range with a maximum CVSSv3 base score of 9.1.

A malicious actor with network access to VMware Aria Operations for Networks and valid ‘member’ role credentials may be able to perform a deserialization attack resulting in remote code execution.

To remediate CVE-2023-20888 apply the updates listed in the ‘Fixed Version’ column of the ‘Response Matrix’ below.

None.

None.

None.

VMware would like to thank Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam) working with Trend Micro Zero Day Initiative for reporting this issue to us.

Aria Operations for Networks contains an information disclosure vulnerability. VMware has evaluated the severity of this issue to be in the important severity range with a maximum CVSSv3 base score of 8.8.

A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in information disclosure.

To remediate CVE-2023-20889 apply the updates listed in the ‘Fixed Version’ column of the ‘Response Matrix’ below.

None.

None.

None.

VMware would like to thank Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam) working with Trend Micro Zero Day Initiative for reporting this issue to us.

Fixed Version(s) and Release Notes:

VMware Aria Operations for Networks 6.x HF: KB92684

Mitre CVE Dictionary Links:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20887

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20888

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20889

FIRST CVSSv3 Calculator:

CVE-2023-20887:  https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2023-20888: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVE-2023-20889: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

2023-06-07 VMSA-2023-0012

Initial security advisory.

E-mail: security@vmware.com

PGP key at:
https://kb.vmware.com/kb/1055

VMware Security Advisories
http://www.vmware.com/security/advisories

VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html

VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html

VMware Security & Compliance Blog
https://blogs.vmware.com/security

Twitter
https://twitter.com/VMwareSRC