Vulnerability · Published Oct 20, 2023 · Assigned by vmware
CVE-2023-34051
Critical 9.8
In plain English
A critical-severity incorrect authorization in VMware Aria Operations for Logs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 48.1% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)48.1%top 1.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
VMware Aria Operations for Logs contains an authentication bypass vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | VMware Aria Operations for Logs | VMware Aria Operations for Logs 8.x, VMware Cloud Foundation (VMware Aria Operations for Logs) 5.x 4.x |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H