Vulnerability · Published Apr 20, 2023 · Assigned by vmware
CVE-2023-20865
High 7.2
In plain English
A high-severity command injection in VMware Aria Operations for Logs (formerly vRealize Log Insight). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)1.6%top 23.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
VMware Aria Operations for Logs contains a command injection vulnerability. A malicious actor with administrative privileges in VMware Aria Operations for Logs can execute arbitrary commands as root.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | VMware Aria Operations for Logs (formerly vRealize Log Insight) | VMware Aria Operations for Logs (formerly vRealize Log Insight) prior to 8.12 |
Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H