Detections
Analytics
VMWare Aria Operations for Networks Multiple Vulnerabilities (VMSA-2023-0012)
critical Nessus Plugin ID 177347
Language:
Synopsis
A web application running on the remote server is affected by multiple vulnerabilities.Description
According to its self-reported version, the instance of VMWare Aria Operations for Networks running on the remote web server is 6.x < 6.2.0.1684162127, 6.3.x < 6.3.0.1684163738, 6.4.x < 6.4.0.1684166601, 6.5.x < 6.5.1.1684151627, 6.6.x < 6.6.0.1684154516, 6.7.x < 6.7.0.1684151941, 6.8.x < 6.8.0.1684995353, 6.9.x < 6.9.0.1684998280, or 6.10.x < 6.10.0.1685358321. It is, therefore, affected by multiple vulnerabilities:- A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution. (CVE-2023-20887)
- A malicious actor with network access to VMware Aria Operations for Networks and valid 'member' role credentials may be able to perform a deserialization attack resulting in remote code execution. (CVE-2023-20888)
- A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in information disclosure. (CVE-2023-20889) Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Upgrade to VMWare Aria Operations for Networks 6.2.0.1684162127, 6.3.0.1684163738, 6.4.0.1684166601, 6.5.1.1684151627, 6.6.0.1684154516, 6.7.0.1684151941, 6.8.0.1684995353, 6.9.0.1684998280, or 6.10.0.1685358321 or later.See Also
https://www.vmware.com/security/advisories/VMSA-2023-0012.html
Plugin Details
Severity: Critical
ID: 177347
File Name: vmware_aria_operations_for_networks_VMSA-2023-0012.nasl
Version: 1.6
Type: remote
Family: CGI abuses
Published: 6/15/2023
Updated: 9/26/2023
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Critical
Score: 9.2
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 8.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2023-20887
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 9.4
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:vmware:vrealize_network_insight, x-cpe:/a:vmware:aria_operations_for_networks
Required KB Items: installed_sw/VMware Aria Operations for Networks
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 6/7/2023
Vulnerability Publication Date: 6/7/2023
CISA Known Exploited Vulnerability Due Dates: 7/13/2023
Exploitable With
Core Impact
Metasploit (VMWare Aria Operations for Networks (vRealize Network Insight) pre-authenticated RCE)