The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:5313 advisory.

  - A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-     vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine     may be able to elevate their privileges if that target virtual machine has been assigned a more privileged     Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-     public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-     db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html . (CVE-2023-20900)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:5313 advisory.

  - A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-     vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine     may be able to elevate their privileges if that target virtual machine has been assigned a more privileged     Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-     public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-     db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html . (CVE-2023-20900)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3795-1 advisory.

    Update to 12.3.0 (build 22234872) (bsc#1214850)

    - There are no new features in the open-vm-tools 12.3.0 release. This is       primarily a maintenance release that addresses a few critical problems,       including:
      - This release integrates CVE-2023-20900 without the need for a patch.
        For more information on this vulnerability and its impact on VMware         products, see         https://www.vmware.com/security/advisories/VMSA-2023-0019.html.
      - A tools.conf configuration setting is available to temporaily direct         Linux quiesced snaphots to restore pre open-vm-tools 12.2.0 behavior         of ignoring file systems already frozen.
      - Building of the VMware Guest Authentication Service (VGAuth) using         'xml-security-c' and 'xerces-c' is being deprecated.
      - A number of Coverity reported issues have been addressed.
      - A number of GitHub issues and pull requests have been handled.
        Please see the Resolves Issues section of the Release Notes.
      - For issues resolved in this release, see the Resolved Issues section         of the Release Notes.
    - For complete details, see:
      https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.0
    - Release Notes are available at       https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/ReleaseNotes.md
    - The granular changes that have gone into the 12.3.0 release are in the       ChangeLog at       https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/open-vm-tools/ChangeLog
    - Fix (bsc#1205927) - hv_vmbus module is loaded unnecessarily in VMware guests
    - jsc#PED-1344 - reinable building containerinfo plugin for SLES 15 SP4.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the open-vm- tools-12.2.5-2.el9 build changelog.

  - SAML token signature bypass [rhel-9]) (CVE-2023-20900)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2023:0226 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2023-20900:
      A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-     vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html  in a target virtual machine     may be able to elevate their privileges if that target virtual machine has been assigned a more privileged     Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-     public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-     db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0041 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-20900:
    A malicious actor that has been granted  Guest Operation Privileges https://docs.vmware.com/en/VMware-     vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine     may be able to elevate their privileges if that target virtual machine has been assigned a more privileged     Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-     public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-     db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .

    CVE-2023-34058:
    VMware Tools contains a SAML token signature bypass vulnerability.A malicious actor that has been     granted  Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-     security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be able to     elevate their privileges if that target virtual machine has been assigned a more privileged  Guest Alias     https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-     db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .

    CVE-2023-34059:
    open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper.A     malicious actor with non-root privileges may be able to hijack the     /dev/uinput file descriptor allowing them to simulate user inputs.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-6434:09 advisory.

    * open-vm-tools: SAML token signature bypass (CVE-2023-20900)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
181804	AlmaLinux 9 : open-vm-tools (ALSA-2023:5313)	Nessus	Alma Linux Local Security Checks	9/22/2023	11/2/2023	high
181885	Rocky Linux 9 : open-vm-tools (RLSA-2023:5313)	Nessus	Rocky Linux Local Security Checks	9/26/2023	11/2/2023	high
181907	SUSE SLES12: libvmtools0 / open-vm-tools / open-vm-tools-desktop / etc (SUSE-SU-2023:3795-1)	Nessus	SuSE Local Security Checks	9/27/2023	6/26/2026	high
191147	CentOS 9 : open-vm-tools-12.2.5-2.el9	Nessus	CentOS Local Security Checks	2/29/2024	4/26/2024	high
239402	TencentOS Server 3: open-vm-tools (TSSA-2023:0226)	Nessus	Tencent Local Security Checks	6/16/2025	11/20/2025	high
276420	TencentOS Server 4: open-vm-tools (TSSA-2024:0041)	Nessus	Tencent Local Security Checks	11/20/2025	11/20/2025	high
291871	MiracleLinux 8 : open-vm-tools-12.1.5-2.el8.3.ML.1 (AXSA:2023-6434:09)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high