Privilege Escalation Vulnerability in VMware vSphere Affecting Guest Operations
CVE-2023-20900

7.5HIGH

Key Information:

Vendor
Vmware
Status
VMware Tools
VMware Tools (open-vm-tools)
Vendor
CVE Published:
31 August 2023

Summary

A vulnerability exists within VMware vSphere that allows a malicious actor with Guest Operation Privileges in a virtual machine to potentially elevate their privileges. This issue arises when the virtual machine has been assigned a more privileged Guest Alias, enabling unauthorized access to higher-level operations and potentially compromising the integrity of the host and other guest instances.

Affected Version(s)

VMware Tools (open-vm-tools) Linux 12.x.x

VMware Tools (open-vm-tools) Linux 11.x.x

VMware Tools (open-vm-tools) Linux 10.3.x

References

https://www.vmware.com/security/advisories/VMSA-2023-0019...
http://www.openwall.com/lists/oss-security/2023/08/31/1
https://www.debian.org/security/2023/dsa-5493

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.