{"id":4461,"date":"2023-07-07T02:00:07","date_gmt":"2023-07-07T01:00:07","guid":{"rendered":"https:\/\/www.sebae.net\/blog\/vmsa-2023-0015\/"},"modified":"2023-07-07T02:00:07","modified_gmt":"2023-07-07T01:00:07","slug":"vmsa-2023-0015","status":"publish","type":"post","link":"https:\/\/www.sebae.net\/blog\/vmsa-2023-0015\/","title":{"rendered":"VMSA-2023-0015"},"content":{"rendered":"<div>\n<div class=\"aem-Grid aem-Grid--12 aem-Grid--default--12 \">\n<div class=\"responsivegrid aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"aem-Grid aem-Grid--12 aem-Grid--default--12 \">\n<div class=\"advisories-summary aem-GridColumn aem-GridColumn--default--12\">\n    <link rel=\"stylesheet\" href=\"\/etc.clientlibs\/vmware-modernize-cms\/componentlibrary\/components\/content\/advisories-summary\/clientlibs.min.css\" type=\"text\/css\">\n<section class=\"sa-detail-wrapper section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<div class=\"sa-image-block\">\n<div class=\"sa-severity\">\n<div class=\"sa-moderate\">\n<p>Moderate<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"sa-detail-block\">\n<div class=\"col-md-8\">\n<div class=\"sa-details\">\n<div class=\"sa-row-group\">\n             <label>Advisory ID:<\/label><br \/>\n             <span>VMSA-2023-0015<\/span>\n            <\/div>\n<div class=\"sa-row-group\">\n             <label>CVSSv3 Range:<\/label><br \/>\n             <span>5.3<\/span>\n            <\/div>\n<div class=\"sa-row-group\">\n             <label>Issue Date:<\/label><br \/>\n             <span>2023-07-06<\/span>\n            <\/div>\n<div class=\"sa-row-group\">\n             <label>Updated On:<\/label><br \/>\n             <span>2023-07-06 (Initial Advisory)<\/span>\n            <\/div>\n<div class=\"sa-row-group\">\n             <label>CVE(s):<\/label><br \/>\n             <span>CVE-2023-20899<\/span>\n            <\/div>\n<div class=\"sa-row-group\">\n             <label>Synopsis:<\/label><br \/>\n             <span>VMware SD-WAN update addresses a bypass authentication vulnerability (CVE-2023-20899)<\/span>\n            <\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"col-md-4 sa-summary-link-section\" data-html2canvas-ignore=\"true\">\n          <\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n    <link rel=\"stylesheet\" href=\"\/etc.clientlibs\/vmware-modernize-cms\/componentlibrary\/components\/content\/secadvheading\/clientlibs.min.css\" type=\"text\/css\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<h5 id=\"1-impacted-products\" class=\"mt-30\"><b>1. Impacted Products<\/b><\/h5>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>VMware SD-WAN (Edge)<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<h5 id=\"2-introduction\" class=\"mt-30\"><b>2. Introduction<\/b><\/h5>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>An Authentication Bypass Vulnerability affecting VMware SD-WAN was privately reported to VMware. Updates are available to address this vulnerability in affected VMware products.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<h5 id=\"3-vmware-sd-wan-bypass-authentication-vulnerability-cve-2023-20899\" class=\"mt-30\"><b>3. VMware SD-WAN Bypass Authentication Vulnerability (CVE-2023-20899)<\/b><\/h5>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Description<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>VMware SD-WAN contains a bypass authentication vulnerability.\u00a0VMware has evaluated the severity of this issue to be in the\u00a0<a href=\"https:\/\/www.vmware.com\/support\/policies\/security_response.html\">moderate severity range<\/a>\u00a0with a maximum CVSSv3 base score of\u00a0<a href=\"https:\/\/www.first.org\/cvss\/calculator\/3.1#CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N\">5.3<\/a>.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Known Attack Vectors<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>An unauthenticated attacker can download the Diagnostic bundle of the application under VMware SD-WAN Management.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Resolution<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>To remediate\u00a0CVE-2023-20899\u00a0apply the updates listed in the &#8216;Fixed Version&#8217; column of the &#8216;Response Matrix&#8217; below.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Workarounds<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>None<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Additional Documentation<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>None<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Notes<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>This vulnerability affects Edge devices only and not the SD-WAN management console (VCO)<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Acknowledgements<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>VMware would like to thank\u00a0Marco Bruinenberg of Accenture for reporting this issue to us.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Response Matrix<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"advisories-data aem-GridColumn aem-GridColumn--default--12\">\n    <link rel=\"stylesheet\" href=\"\/etc.clientlibs\/vmware-modernize-cms\/componentlibrary\/components\/content\/advisories-data\/clientlibs.min.css\" type=\"text\/css\">\n<section class=\"response-matrix\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<div class=\"section-custom\">\n<div class=\"table-responsive\">\n<table class=\"table\">\n<tbody>\n<tr class=\"tr thead\">\n<td class=\"td\">Product<\/td>\n<td class=\"td\">Version<\/td>\n<td class=\"td\">Running On<\/td>\n<td class=\"td\">CVE Identifier<\/td>\n<td class=\"td\">CVSSv3<\/td>\n<td class=\"td\">Severity<\/td>\n<td class=\"td\">Fixed Version<\/td>\n<td class=\"td\">Workarounds<\/td>\n<td class=\"td\">Additional Documentation<\/td>\n<\/tr>\n<tr class=\"tr\">\n<td class=\"td\" data-th=\"Product\">\n<div class=\"td-content\">\n                VMware SD-WAN (Edge)\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Version\">\n<div class=\"td-content\">\n                5.2\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Running On\">\n<div class=\"td-content\">\n                Any\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"CVE Identifier\">\n<div class=\"td-content\">\n                CVE-2023-20899\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"CVSSV3\">\n<div class=\"td-content\">\n                N\/A\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Severity\">\n<div class=\"td-content\">\n<div class=\"sa-severity-blk\">\n                 N\/A\n                <\/div>\n<\/p><\/div>\n<\/td>\n<td class=\"td\" data-th=\"Fixed Version\">\n<div class=\"td-content\">\n                Unaffected\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Workarounds\">\n<div class=\"td-content\">\n                None\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Additional Documents\">\n<div class=\"td-content\">\n                None\n               <\/div>\n<\/td>\n<\/tr>\n<tr class=\"tr\">\n<td class=\"td\" data-th=\"Product\">\n<div class=\"td-content\">\n                VMware SD-WAN (Edge)\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Version\">\n<div class=\"td-content\">\n                5.1.x\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Running On\">\n<div class=\"td-content\">\n                Any\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"CVE Identifier\">\n<div class=\"td-content\">\n                CVE-2023-20899\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"CVSSV3\">\n<div class=\"td-content\">\n                N\/A\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Severity\">\n<div class=\"td-content\">\n<div class=\"sa-severity-blk\">\n                 N\/A\n                <\/div>\n<\/p><\/div>\n<\/td>\n<td class=\"td\" data-th=\"Fixed Version\">\n<div class=\"td-content\">\n                Unaffected\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Workarounds\">\n<div class=\"td-content\">\n                None\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Additional Documents\">\n<div class=\"td-content\">\n                None\n               <\/div>\n<\/td>\n<\/tr>\n<tr class=\"tr\">\n<td class=\"td\" data-th=\"Product\">\n<div class=\"td-content\">\n                VMware SD-WAN (Edge)\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Version\">\n<div class=\"td-content\">\n                5.0.x\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Running On\">\n<div class=\"td-content\">\n                Any\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"CVE Identifier\">\n<div class=\"td-content\">\n                CVE-2023-20899\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"CVSSV3\">\n<div class=\"td-content\">\n                <a aria-label=\"5.3\" href=\"https:\/\/www.first.org\/cvss\/calculator\/3.1#CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N\">5.3<\/a>\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Severity\">\n<div class=\"td-content\">\n<div class=\"sa-severity-blk\">\n                 moderate\n                <\/div>\n<p>                <span class=\"sa-severity sa-moderate\"><\/span>\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Fixed Version\">\n<div class=\"td-content\">\n                <a aria-label=\"5.1\" href=\"https:\/\/docs.vmware.com\/en\/VMware-SASE\/5.1.0\/rn\/vmware-sase-510-release-notes\/index.html\">5.1<\/a>\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Workarounds\">\n<div class=\"td-content\">\n                None\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Additional Documents\">\n<div class=\"td-content\">\n                None\n               <\/div>\n<\/td>\n<\/tr>\n<tr class=\"tr\">\n<td class=\"td\" data-th=\"Product\">\n<div class=\"td-content\">\n                VMware SD-WAN (Edge)\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Version\">\n<div class=\"td-content\">\n                4.5.x\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Running On\">\n<div class=\"td-content\">\n                Any\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"CVE Identifier\">\n<div class=\"td-content\">\n                CVE-2023-20899\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"CVSSV3\">\n<div class=\"td-content\">\n                <a aria-label=\"5.3\" href=\"https:\/\/www.first.org\/cvss\/calculator\/3.1#CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N\">5.3<\/a>\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Severity\">\n<div class=\"td-content\">\n<div class=\"sa-severity-blk\">\n                 moderate\n                <\/div>\n<p>                <span class=\"sa-severity sa-moderate\"><\/span>\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Fixed Version\">\n<div class=\"td-content\">\n                <a aria-label=\"4.5.2\" href=\"https:\/\/customerconnect.vmware.com\/en\/downloads\/info\/slug\/networking_security\/vmware_sd_wan\/4_5_2\">4.5.2<\/a>\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Workarounds\">\n<div class=\"td-content\">\n                None\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Additional Documents\">\n<div class=\"td-content\">\n                None\n               <\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<h5 id=\"4-references\" class=\"mt-30\"><b>4. References<\/b><\/h5>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p><b>Fixed Version(s) and Release Notes:<\/b><\/p>\n<p>VMware SD-WAN 5.1 Release Notes:\u00a0<a href=\"https:\/\/docs.vmware.com\/en\/VMware-SASE\/5.1.0\/rn\/vmware-sase-510-release-notes\/index.html\">https:\/\/docs.vmware.com\/en\/VMware-SASE\/5.1.0\/rn\/vmware-sase-510-release-notes\/index.html<\/a><\/p>\n<p>VMware SD-WAN 4.5.2 Release Notes:\u00a0<a href=\"https:\/\/docs.vmware.com\/en\/VMware-SASE\/4.5.1\/rn\/vmware-sase-452-release-notes\/index.html\">https:\/\/docs.vmware.com\/en\/VMware-SASE\/4.5.2\/rn\/vmware-sase-452-release-notes\/index.html<\/a><\/p>\n<p><b>Downloads and Documentation:<\/b><\/p>\n<p><a href=\"https:\/\/customerconnect.vmware.com\/en\/downloads\/info\/slug\/networking_security\/vmware_sd_wan\/5_1_0\">https:\/\/customerconnect.vmware.com\/en\/downloads\/info\/slug\/networking_security\/vmware_sd_wan\/5_1_0<\/a><\/p>\n<p><a href=\"https:\/\/customerconnect.vmware.com\/en\/downloads\/info\/slug\/networking_security\/vmware_sd_wan\/4_5_2\">https:\/\/customerconnect.vmware.com\/en\/downloads\/info\/slug\/networking_security\/vmware_sd_wan\/4_5_2<\/a><\/p>\n<p><b>Mitre CVE Dictionary Links:<\/b><\/p>\n<p><a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-20899\">https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-20899<\/a><\/p>\n<p><b>FIRST CVSSv3 Calculator:<\/b><\/p>\n<p>CVE-2023-20899:\u00a0<a href=\"https:\/\/www.first.org\/cvss\/calculator\/3.1#CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N\">https:\/\/www.first.org\/cvss\/calculator\/3.1#CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N<\/a><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<h5 id=\"5-change-log\" class=\"mt-30\"><b>5. Change Log<\/b><\/h5>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text   text-gray  \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\" value=\"1534342432001-Byh3doRJx\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p><b>2023-07-06 VMSA-2023-0015<\/b><\/p>\n<p>Initial security advisory.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n   <\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<h5 id=\"6-contact\" class=\"mt-30\"><b>6. Contact<\/b><\/h5>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>E-mail list for product security notifications and announcements:<\/p>\n<p><a href=\"https:\/\/lists.vmware.com\/cgi-bin\/mailman\/listinfo\/security-announce\">https:\/\/lists.vmware.com\/cgi-bin\/mailman\/listinfo\/security-announce\u00a0<\/a><\/p>\n<p>\u00a0<\/p>\n<p>This Security Advisory is posted to the following lists:\u00a0\u00a0<\/p>\n<p><a href=\"mailto:security-announce@lists.vmware.com\">security-announce@lists.vmware.com\u00a0\u00a0<\/a><\/p>\n<p><a href=\"mailto:bugtraq@securityfocus.com\">bugtraq@securityfocus.com\u00a0\u00a0<\/a><\/p>\n<p><a href=\"mailto:fulldisclosure@seclists.org\">fulldisclosure@seclists.org\u00a0<\/a><\/p>\n<p>\u00a0<\/p>\n<p>E-mail: <a href=\"mailto:security@vmware.com\">security@vmware.com<\/a><\/p>\n<p>PGP key at:<\/p>\n<p><a href=\"https:\/\/kb.vmware.com\/kb\/1055\">https:\/\/kb.vmware.com\/kb\/1055\u00a0<\/a><\/p>\n<p>\u00a0<\/p>\n<p>VMware Security Advisories<\/p>\n<p><a href=\"https:\/\/www.vmware.com\/security\/advisories\">https:\/\/www.vmware.com\/security\/advisories\u00a0<\/a><\/p>\n<p>\u00a0<\/p>\n<p>VMware Security Response Policy<\/p>\n<p><a href=\"https:\/\/www.vmware.com\/support\/policies\/security_response.html\">https:\/\/www.vmware.com\/support\/policies\/security_response.html\u00a0<\/a><\/p>\n<p>\u00a0<\/p>\n<p>VMware Lifecycle Support Phases<\/p>\n<p><a href=\"https:\/\/www.vmware.com\/support\/policies\/lifecycle.html\">https:\/\/www.vmware.com\/support\/policies\/lifecycle.html\u00a0<\/a><\/p>\n<p>\u00a0<\/p>\n<p>VMware Security &amp; Compliance Blog\u00a0\u00a0<\/p>\n<p><a href=\"https:\/\/blogs.vmware.com\/security\">https:\/\/blogs.vmware.com\/security\u00a0<\/a><\/p>\n<p>\u00a0<\/p>\n<p>Twitter<\/p>\n<p><a href=\"https:\/\/twitter.com\/VMwareSRC\">https:\/\/twitter.com\/VMwareSRC<br \/> <\/a><\/p>\n<p>\u00a0<\/p>\n<p>Copyright 2023 VMware Inc. All rights reserved.<br \/> \u00a0 <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div>\n<p><a href=\"https:\/\/www.vmware.com\/security\/advisories\/VMSA-2023-0015.html\">Read full article (vmware.com)<\/a><\/p>\n<p>All content and images belong to their respected owners, this article is curated for informational purposes only.<\/p>\n","protected":false},"excerpt":{"rendered":"Moderate Advisory ID: VMSA-2023-0015 CVSSv3 Range: 5.3 Issue Date: 2023-07-06 Updated On: 2023-07-06 (Initial Advisory) CVE(s): CVE-2023-20899 Synopsis:&hellip;\n","protected":false},"author":2,"featured_media":2586,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"csco_singular_sidebar":"","csco_page_header_type":"","csco_appearance_grid":"","csco_page_load_nextpost":"","csco_post_video_location":[],"csco_post_video_location_hash":"","csco_post_video_url":"","csco_post_video_bg_start_time":0,"csco_post_video_bg_end_time":0,"footnotes":""},"categories":[16],"tags":[390,389,1891],"coauthors":[48],"class_list":["post-4461","post","type-post","status-publish","format-standard","has-post-thumbnail","category-vmware-virtualisation","tag-advisory","tag-moderate","tag-vmsa20230015","cs-entry","cs-video-wrap"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>VMSA-2023-0015 | Sebae Networks<\/title>\n<meta name=\"description\" content=\"View VMSA-2023-0015 for free, here at Sebae. Discover more great posts on our website.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.sebae.net\/blog\/vmsa-2023-0015\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"VMSA-2023-0015 | Sebae Networks\" \/>\n<meta property=\"og:description\" content=\"View VMSA-2023-0015 for free, here at Sebae. Discover more great posts on our website.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.sebae.net\/blog\/vmsa-2023-0015\/\" \/>\n<meta property=\"og:site_name\" content=\"Sebae Networks\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/sebaenetworks\" \/>\n<meta property=\"article:published_time\" content=\"2023-07-07T01:00:07+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2023\/12\/sebae-logo-card.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"675\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"James Dean\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@sebaenetworks\" \/>\n<meta name=\"twitter:site\" content=\"@sebaenetworks\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"James Dean\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"VMSA-2023-0015 | Sebae Networks","description":"View VMSA-2023-0015 for free, here at Sebae. Discover more great posts on our website.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.sebae.net\/blog\/vmsa-2023-0015\/","og_locale":"en_GB","og_type":"article","og_title":"VMSA-2023-0015 | Sebae Networks","og_description":"View VMSA-2023-0015 for free, here at Sebae. Discover more great posts on our website.","og_url":"https:\/\/www.sebae.net\/blog\/vmsa-2023-0015\/","og_site_name":"Sebae Networks","article_publisher":"https:\/\/www.facebook.com\/sebaenetworks","article_published_time":"2023-07-07T01:00:07+00:00","og_image":[{"width":1200,"height":675,"url":"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2023\/12\/sebae-logo-card.jpg","type":"image\/jpeg"}],"author":"James Dean","twitter_card":"summary_large_image","twitter_creator":"@sebaenetworks","twitter_site":"@sebaenetworks","twitter_misc":{"Written by":"James Dean","Estimated reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.sebae.net\/blog\/vmsa-2023-0015\/#article","isPartOf":{"@id":"https:\/\/www.sebae.net\/blog\/vmsa-2023-0015\/"},"author":{"name":"James Dean","@id":"https:\/\/www.sebae.net\/blog\/#\/schema\/person\/6d07e05e3d3e4483117c4e2c3315a89f"},"headline":"VMSA-2023-0015","datePublished":"2023-07-07T01:00:07+00:00","mainEntityOfPage":{"@id":"https:\/\/www.sebae.net\/blog\/vmsa-2023-0015\/"},"wordCount":476,"commentCount":0,"publisher":{"@id":"https:\/\/www.sebae.net\/blog\/#organization"},"image":{"@id":"https:\/\/www.sebae.net\/blog\/vmsa-2023-0015\/#primaryimage"},"thumbnailUrl":"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2021\/11\/vmware-logo-header.png","keywords":["Advisory","Moderate","VMSA20230015"],"articleSection":["VMware Virtualisation"],"inLanguage":"en-GB","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.sebae.net\/blog\/vmsa-2023-0015\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.sebae.net\/blog\/vmsa-2023-0015\/","url":"https:\/\/www.sebae.net\/blog\/vmsa-2023-0015\/","name":"VMSA-2023-0015 | Sebae Networks","isPartOf":{"@id":"https:\/\/www.sebae.net\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.sebae.net\/blog\/vmsa-2023-0015\/#primaryimage"},"image":{"@id":"https:\/\/www.sebae.net\/blog\/vmsa-2023-0015\/#primaryimage"},"thumbnailUrl":"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2021\/11\/vmware-logo-header.png","datePublished":"2023-07-07T01:00:07+00:00","description":"View VMSA-2023-0015 for free, here at Sebae. Discover more great posts on our website.","breadcrumb":{"@id":"https:\/\/www.sebae.net\/blog\/vmsa-2023-0015\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.sebae.net\/blog\/vmsa-2023-0015\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.sebae.net\/blog\/vmsa-2023-0015\/#primaryimage","url":"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2021\/11\/vmware-logo-header.png","contentUrl":"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2021\/11\/vmware-logo-header.png","width":1920,"height":1080,"caption":"vmware logo header"},{"@type":"BreadcrumbList","@id":"https:\/\/www.sebae.net\/blog\/vmsa-2023-0015\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.sebae.net\/blog\/"},{"@type":"ListItem","position":2,"name":"VMSA-2023-0015"}]},{"@type":"WebSite","@id":"https:\/\/www.sebae.net\/blog\/#website","url":"https:\/\/www.sebae.net\/blog\/","name":"Sebae Networks","description":"Tech Tips, News, Tutorials &amp; Advice","publisher":{"@id":"https:\/\/www.sebae.net\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.sebae.net\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/www.sebae.net\/blog\/#organization","name":"Sebae","url":"https:\/\/www.sebae.net\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.sebae.net\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2023\/06\/sebae-logo-icon.png","contentUrl":"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2023\/06\/sebae-logo-icon.png","width":512,"height":512,"caption":"Sebae"},"image":{"@id":"https:\/\/www.sebae.net\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/sebaenetworks","https:\/\/x.com\/sebaenetworks"]},{"@type":"Person","@id":"https:\/\/www.sebae.net\/blog\/#\/schema\/person\/6d07e05e3d3e4483117c4e2c3315a89f","name":"James Dean","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2021\/10\/avatar_user_2_1634496168-96x96.jpg72371c27260698ee55141397050ef40a","url":"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2021\/10\/avatar_user_2_1634496168-96x96.jpg","contentUrl":"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2021\/10\/avatar_user_2_1634496168-96x96.jpg","caption":"James Dean"},"sameAs":["https:\/\/www.sebae.net"],"url":"https:\/\/www.sebae.net\/blog\/author\/jdean\/"}]}},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/posts\/4461","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/comments?post=4461"}],"version-history":[{"count":0,"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/posts\/4461\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/media\/2586"}],"wp:attachment":[{"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/media?parent=4461"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/categories?post=4461"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/tags?post=4461"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/coauthors?post=4461"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}