Vmware Aria Operations for Networks Command Injection Vulnerability
Summary
| CVE | CVE-2023-20887 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-06-07 15:15:00 UTC |
| Updated | 2023-07-26 17:15:00 UTC |
| Description | Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution. |
Risk And Classification
EPSS: 0.942580000 probability, percentile 0.999350000 (date 2026-04-22)
CISA KEV: Listed on 2023-06-22; due 2023-07-13; ransomware use Unknown
Problem Types: CWE-77
CISA Known Exploited Vulnerability
| Vendor | VMware |
|---|---|
| Product | Aria Operations for Networks |
| Name | Vmware Aria Operations for Networks Command Injection Vulnerability |
| Required Action | Apply updates per vendor instructions. |
| Notes | https://www.vmware.com/security/advisories/VMSA-2023-0012.html; https://nvd.nist.gov/vuln/detail/CVE-2023-20887 |
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Vmware | Vrealize Network Insight | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| VMSA-2023-0012 | MISC | www.vmware.com | |
| VMWare Aria Operations For Networks Remote Command Execution ≈ Packet Storm | MISC | packetstormsecurity.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
| CISA Known Exploited Vulnerabilities catalog | CISA | www.cisa.gov | kev |
No vendor comments have been submitted for this CVE.