Auth bypass in Vmware Aria_operations_for_logs

CVE-2023-34051

VMware Aria Operations for Logs contains an authentication bypass vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution.

Vulnerability class: Broken Access Control

EPSS: 0.447 (98.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

  • Vmware Aria_operations_for_logs — versions 4.0, 5.0, 8.6
  • N/a Vmware Aria Operations For Logs — versions VMware Aria Operations for Logs 8.x, VMware Cloud Foundation (VMware Aria Operations for Logs) 5.x 4.x

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2023-34051?
CVE-2023-34051 is a critical-severity vulnerability in Vmware Aria_operations_for_logs, classified under Incorrect Authorization. CVSS score: 9.8/10. Published 2023-10-20.
How severe is CVE-2023-34051?
Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2023-34051 known to be exploited?
12 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.