CSRF Bypass Vulnerability in VMware vRealize Operations
CVE-2023-20856

8.8HIGH

Key Information:

Vendor
Vmware
Status
VMware vRealize Operations (vROps)
Vendor
CVE Published:
1 February 2023

Summary

VMware vRealize Operations contains a CSRF bypass vulnerability that allows an attacker to perform unauthorized actions on the platform. This occurs as a result of a flaw in the application's handling of requests, which can be exploited by a malicious user to execute actions as an authenticated victim user, potentially leading to unwanted modifications or data breaches. Users are urged to review security advisories and implement recommended mitigations to safeguard their environments.

Affected Version(s)

VMware vRealize Operations (vROps) vRealize Operations Manager (vROps) 8.6.4

References

https://www.vmware.com/security/advisories/VMSA-2023-0002...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.