CVE-2023-20887

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 98,3%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada vmware aria operations for networks. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 22 Juni 2023, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.

Rincian

Terbit di NVD

7 Juni 2023

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

EPSS (30 hari)

98,3% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Vmware Aria Operations for Networks Command Injection Vulnerability

Masuk KEV

22 Juni 2023

Tenggat CISA

13 Juli 2023 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.vmware.com/security/advisories/VMSA-2023-0012.html patch · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20887 pemerintah AS
• http://packetstormsecurity.com/files/173761/VMWare-Aria-Operations-For-Networks-Remote-Command-Execution.html exploit · advisory pihak ketiga · vdb entry