CVE-2023-20887 Vmware Aria Operations for Networks Command Injection
Attackers with network access can execute arbitrary commands on VMware Aria Operations for Networks, leading to remote code execution.
- Exploited in the wild
- Since 22 Jun 2023
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-20887?
CVE-2023-20887 is a critical command injection vulnerability in Aria Operations for Networks (Formerly vRealize Network Insight), published on 7 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.
Weakness: CWE-77
Which versions are affected by CVE-2023-20887?
It affects 1 product.
Products include Vmware Aria Operations for Networks.
How do I fix CVE-2023-20887?
No fix has been published for CVE-2023-20887 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 13 Jul 2023.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-20887 being exploited?
Yes. Attackers have exploited CVE-2023-20887 in the wild since at least 22 Jun 2023.
Public exploit code: 1 Metasploit module, 1 Nuclei template and 3 proofs of concept on GitHub.
Other vulnerabilities in Aria Operations for Networks (Formerly vRealize Network Insight)
- CVE-2023-34039 Auth bypass in Aria Operations for Networks
- CVE-2024-22237 Privilege escalation in VMware Aria Operations for Networks
- CVE-2023-20890 Path traversal in Aria Operations for Networks
- CVE-2024-22238 Cross-site scripting in VMware Aria Operations for Networks
- CVE-2024-22239 Privilege escalation in VMware Aria Operations for Networks
Sources
Also known as GHSA-8vx8-r5j3-f2vf.