CVE-2023-20887 — Vmware Aria Operations for Networks Command Injection Vulnerability
CVE-2023-20887: Vmware Aria Operations for Networks Command Injection Vulnerability
CISA Known Exploited Vulnerability (KEV)
| Vendor / project | VMware |
| Product | Aria Operations for Networks |
| Date added | 2023-06-22 |
| Due date | 2023-07-13 |
| Ransomware campaign use | Unknown |
Description
VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack resulting in remote code execution.
Required action (CISA)
Apply updates per vendor instructions.
Notes
https://www.vmware.com/security/advisories/VMSA-2023-0012.html; https://nvd.nist.gov/vuln/detail/CVE-2023-20887
References
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-20887
- KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog