CVE-2023-20865 is a command injection vulnerability in VMware Aria Operations for Logs and VMware Cloud Foundation. An attacker with administrative privileges can exploit this flaw to execute arbitrary commands as root. This high-severity vulnerability (CVSS 7.2) allows for complete compromise of confidentiality, integrity, and availability, with low attack complexity. While not currently listed in CISA KEV, there is significant community discussion and media coverage, indicating awareness and potential for future exploitation, though no public exploit code is yet available.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 8.6.0, < 8.12.0CPE matchmatch criteria | cpe:2.3:a:vmware:aria_operations_for_logs:*:*:*:*:*:*:*:* | ||
>= 4.0, <= 4.5CPE matchmatch criteria | cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.3 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.