Warning: Proof-of-concept exploit available for an authentication bypass vulnerability in VMware Aria Operations for Logs!
CVE-2023-34051: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Bronnen
https://www.vmware.com/security/advisories/VMSA-2023-0021.html
Risico’s
CVE-2023-34051 is a high-severity vulnerability, with a CVSS score of 8.1. The vulnerability circumvents the patch for VMSA-2023-0001 in VMware Aria Operations for Logs (formerly known as VMware vRealize Log Insight).
The exploitation of the vulnerability could have severe consequences, with high impact to confidentiality, integrity and availability of the targeted systems. At the moment the vulnerability was not observed as being exploited by threat actors, but it is likely to be exploited by threat actors, as the PoC is now available.
Beschrijving
The high severity of the vulnerability is due to the fact that it allows an unauthenticated, malicious actor to inject files into the operating system of an impacted appliance which can result in remote code execution. The attacker could then execute commands as root on the system affecting the combination of confidentiality, integrity, and availability.
A Proof-of-concept exploit for the vulnerability has been published.
Aanbevolen acties
The Centre for Cybersecurity Belgium strongly recommends system administrators to apply the updates listed in the 'Fixed Version' column of the 'Response Matrix' available at:
https://www.vmware.com/security/advisories/VMSA-2023-0021.html
Referenties
NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-34051
VMware: