QID 376190

Date Published: 2021-12-20

QID 376190: VMware NSX-T Man-in-the-Middle (MITM) Vulnerability (VMSA-2020-0023)

VMware NSX-T Data Center provides an agile software-defined infrastructure to build cloud-native application environments.

VMware NSX-T contains a security vulnerability that exists in the way it allows a KVM host to download and install packages from NSX manager. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.5.
Affected Versions
VMware NSX-T versions 2.5.x prior to 2.5.2.2.0
VMware NSX-T versions 3.x prior to 3.0.2

QID Detection Logic (Authenticated):
The QID checks the vulnerable version of VMware NSX-T.

A malicious actor with MITM positioning may be able to exploit this issue to compromise the transport node.

CVSS V3 rated as Medium - 5.9 severity.

CVSS V2 rated as Medium - 4.3 severity.

Solution

VMware has released patch for VMware ESXi 6.7 , visit VMware NSX-T

Refer to VMware advisory VMSA-2020-0023 for more information.

Vendor References

VMSA-2020-0023 - www.vmware.com/security/advisories/VMSA-2020-0023.html

CVEs related to QID 376190

CVE-2020-3993 |

Software Advisories

Advisory ID	Software	Component	Link
VMSA-2020-0023			www.vmware.com/security/advisories/VMSA-2020-0023.html

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].