« Volver al listado

CVE-2023-34052

Estado: ModificadaAlta (7.8)—

VMware Aria Operations for Logs contains a deserialization vulnerability. A malicious actor with non-administrative access to the local system can trigger the deserialization of data which could result in authentication bypass.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Vmware — Aria Operations FOR Logs

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-34052",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-34052",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-12T14:39:01.569396Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "VMware Aria Operations for Logs",
          "versions": [
            {
              "status": "affected",
              "version": "VMware Aria Operations for Logs 8.x, VMware Cloud Foundation (VMware Aria Operations for Logs) 5.x 4.x "
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-10-20T05:15:08.420",
  "references": [
    {
      "url": "https://www.vmware.com/security/advisories/VMSA-2023-0021.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "https://www.vmware.com/security/advisories/VMSA-2023-0021.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "VMware Aria Operations for Logs contains a deserialization vulnerability. A malicious actor with non-administrative access to the local system can trigger the deserialization of data which could result in authentication bypass.\n"
    },
    {
      "lang": "es",
      "value": "VMware Aria Operations for Logs contiene una vulnerabilidad de deserialización. Un actor malintencionado con acceso no administrativo al sistema local puede desencadenar la deserialización de datos, lo que podría provocar una omisión de autenticación."
    }
  ],
  "lastModified": "2026-06-17T06:02:49.717",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:aria_operations_for_logs:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F207E7F7-B239-46F4-90FC-D8CC090B72FB"
            },
            {
              "criteria": "cpe:2.3:a:vmware:aria_operations_for_logs:5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3E25A8E-8FDD-4B2E-AC3A-5D70C0DEE483"
            },
            {
              "criteria": "cpe:2.3:a:vmware:aria_operations_for_logs:8.10.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E8FEEA71-A044-41E4-99A3-80095746C997"
            },
            {
              "criteria": "cpe:2.3:a:vmware:aria_operations_for_logs:8.12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "255AB7A4-C8AB-4010-9CE2-F5743CF3C327"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@vmware.com"
}