CVE-2023-20855

Summary

CVE	CVE-2023-20855
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2023-02-22 00:15:00 UTC
Updated	2023-03-03 14:04:00 UTC
Description	VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. A malicious actor, with non-administrative access to vRealize Orchestrator, may be able to use specially crafted input to bypass XML parsing restrictions leading to access to sensitive information or possible escalation of privileges.

Risk And Classification

Problem Types: CWE-611

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Vmware	Vrealize Automation	All	All	All	All
Application	Vmware	Vrealize Orchestrator	All	All	All	All

References

Reference	Source	Link	Tags
VMSA-2023-0005	MISC	www.vmware.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

378018 VMware vRealize Orchestrator and VMware vRealize Automation Extensible Markup Language (XML) External Entity (XXE) Vulnerability (VMSA-2023-0005)