CVE-2023-20867

UNKNOWNKnown Exploited

CISA Known Exploited Vulnerability

https://www.vmware.com/security/advisories/VMSA-2023-0013.html; https://nvd.nist.gov/vuln/detail/CVE-2023-20867

Remediation deadline: July 14, 2023

Description

VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access over ESXi to exploit this vulnerability.

Timeline

Published:June 23rd, 2023 12:00 AM

Last modified:June 23rd, 2023 12:00 AM

Added to KEV:June 23rd, 2023

CVSS Scoring

No CVSS v3 score available

Affected Software

From NVD CPE configuration data

Vendors

VMware

Products

Tools

Weaknesses (CWE)

CWE-287

References & Reports

Advisories, patches, and third-party reports

No references available.

Source: CISA KEV + NVD · Data may lag official sources by up to one minute