« Volver al listado

CVE-2023-34051

Estado: ModificadaCrítica (9.8)—

VMware Aria Operations for Logs contains an authentication bypass vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Vmware — Aria Operations FOR Logs

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-34051",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-34051",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-23T13:26:59.723332Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "VMware Aria Operations for Logs",
          "versions": [
            {
              "status": "affected",
              "version": "VMware Aria Operations for Logs 8.x, VMware Cloud Foundation (VMware Aria Operations for Logs) 5.x 4.x "
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-10-20T05:15:07.943",
  "references": [
    {
      "url": "https://www.vmware.com/security/advisories/VMSA-2023-0021.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "https://www.vmware.com/security/advisories/VMSA-2023-0021.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "VMware Aria Operations for Logs contains an authentication bypass vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution.\n"
    },
    {
      "lang": "es",
      "value": "VMware Aria Operations for Logs contiene una vulnerabilidad de omisión de autenticación. Un actor malicioso no autenticado puede inyectar archivos en el sistema operativo de un dispositivo afectado, lo que puede resultar en la ejecución remota de código."
    }
  ],
  "lastModified": "2026-06-17T06:02:49.550",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:aria_operations_for_logs:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F207E7F7-B239-46F4-90FC-D8CC090B72FB"
            },
            {
              "criteria": "cpe:2.3:a:vmware:aria_operations_for_logs:5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3E25A8E-8FDD-4B2E-AC3A-5D70C0DEE483"
            },
            {
              "criteria": "cpe:2.3:a:vmware:aria_operations_for_logs:8.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1BA88D24-B7A6-4A4E-A9FF-826FC04578BE"
            },
            {
              "criteria": "cpe:2.3:a:vmware:aria_operations_for_logs:8.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "66B2704F-ECEE-4BCD-B7E4-702A87EA3AF2"
            },
            {
              "criteria": "cpe:2.3:a:vmware:aria_operations_for_logs:8.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8D400E0C-561C-4A87-B047-271DA10288EB"
            },
            {
              "criteria": "cpe:2.3:a:vmware:aria_operations_for_logs:8.10.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E8FEEA71-A044-41E4-99A3-80095746C997"
            },
            {
              "criteria": "cpe:2.3:a:vmware:aria_operations_for_logs:8.12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "255AB7A4-C8AB-4010-9CE2-F5743CF3C327"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@vmware.com"
}