CVE-2023-20864

VMware Aria Operations for Logs contains a deserialization vulnerability. An unauthenticated, malicious actor with network access to VMware Aria Operations for Logs may be able to execute arbitrary code as root.

Affected

VMware Aria Operations for Logs (formerly vRealize Log Insight)

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

70.42% chance of exploitation in the next 30 days, 99th percentile

Nuclei

critical · CWE-502

Published

2023-04-20

Updated

2025-02-05

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-20864.yaml

Security advisories

• https://www.vmware.com/security/advisories/VMSA-2023-0007.html

References

• CVE Record
• NVD entry