CVE-2023-20867
נמוכה 3.9 מנוצלת בשטח (KEV)
ניצול פעיל מאומת — קטלוג CISA KEV
- שם
- VMware Tools Authentication Bypass Vulnerability
- נוסף לקטלוג
- יעד טיפול (פדרלי)
- פעולה נדרשת
- Apply updates per vendor instructions.
תיאור (מקור, אנגלית)
A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.
מדדים
- CVSS 3.1
-
3.9 (LOW)
מקור הציון: NVD
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N - EPSS — סבירות ניצול
- 14% (אחוזון 100) נכון ל-25/7/2026
- CWE
- CWE-287
מוצרים מושפעים
vmware: tools; debian: debian linux; fedoraproject: fedora
קישורים
- https://www.vmware.com/security/advisories/VMSA-2023-0013.html PatchVendor Advisory
- https://www.vmware.com/security/advisories/VMSA-2023-0013.html PatchVendor Advisory
- http://www.openwall.com/lists/oss-security/2023/10/16/11 Mailing ListPatch
- http://www.openwall.com/lists/oss-security/2023/10/16/2 Mailing ListPatch
- http://www.openwall.com/lists/oss-security/2023/10/16/11 Mailing ListPatch
- http://www.openwall.com/lists/oss-security/2023/10/16/2 Mailing ListPatch
- https://lists.debian.org/debian-lts-announce/2023/08/msg00020.html Mailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]… Mailing ListRelease Notes
- https://lists.fedoraproject.org/archives/list/[email protected]… Mailing ListRelease Notes
- https://lists.fedoraproject.org/archives/list/[email protected]… Mailing ListRelease Notes