« Volver al listado

CVE-2023-34063

Estado: ModificadaAlta (8.3)—

Aria Automation contains a Missing Access Control vulnerability.

An authenticated malicious actor may exploit this vulnerability leading to unauthorized access to remote organizations and workflows.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Vmware — Aria AutomationVmware — Cloud Foundation

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-34063",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-34063",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-01-16T20:17:51.196207Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@vmware.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.3,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 5.5,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "N/A",
          "product": "VMware Aria Automation, VMware Cloud Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "Aria Automation 8.14.1, Aria Automation 8.14.0, Aria Automation 8.13.1, Aria Automation 8.13.0, Aria Automation 8.12.2, Aria Automation 8.12.1, Aria Automation 8.12.0, Aria Automation 8.11.2, Aria Automation 8.11.1, Aria Automation 8.11.0      "
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-01-16T10:15:07.347",
  "references": [
    {
      "url": "https://www.vmware.com/security/advisories/VMSA-2024-0001.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "https://www.vmware.com/security/advisories/VMSA-2024-0001.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Aria Automation contains a Missing Access Control vulnerability.\n\n\nAn authenticated malicious actor may \nexploit this vulnerability leading to unauthorized access to remote \norganizations and workflows.\n\n"
    },
    {
      "lang": "es",
      "value": "Aria Automation contiene una vulnerabilidad de control de acceso faltante. Un actor malicioso autenticado puede explotar esta vulnerabilidad y provocar acceso no autorizado a organizaciones y workflows remotos."
    }
  ],
  "lastModified": "2026-06-17T06:02:51.310",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:aria_automation:8.11.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "183DC197-4FF2-4B84-B0E8-666E49CC9DDF"
            },
            {
              "criteria": "cpe:2.3:a:vmware:aria_automation:8.11.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2849AEA0-B419-4096-B1D8-796686CE4C56"
            },
            {
              "criteria": "cpe:2.3:a:vmware:aria_automation:8.11.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CFFC657E-8780-46FE-AC01-22F8CFF196C9"
            },
            {
              "criteria": "cpe:2.3:a:vmware:aria_automation:8.12.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "91E0F535-5F30-495E-9974-2C2F65ED94EE"
            },
            {
              "criteria": "cpe:2.3:a:vmware:aria_automation:8.12.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C8B7BAD1-8544-491E-B41F-B4CD4E2B3754"
            },
            {
              "criteria": "cpe:2.3:a:vmware:aria_automation:8.12.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FF9CA281-ACE8-4768-A5EC-EB29111CD3EC"
            },
            {
              "criteria": "cpe:2.3:a:vmware:aria_automation:8.13.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AB173C24-3DDA-46CA-9B80-9A2C4EB73768"
            },
            {
              "criteria": "cpe:2.3:a:vmware:aria_automation:8.13.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "24986636-3F4B-46CF-A374-0D006216731F"
            },
            {
              "criteria": "cpe:2.3:a:vmware:aria_automation:8.14.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FB6E2175-E4C2-46A7-9D37-E37A8239B16D"
            },
            {
              "criteria": "cpe:2.3:a:vmware:aria_automation:8.14.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6F48CE31-68D2-4FE8-9BB2-ADC85259552A"
            },
            {
              "criteria": "cpe:2.3:a:vmware:cloud_foundation:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "38EB0C0C-56CF-4A8F-A36F-E0E180B9059E"
            },
            {
              "criteria": "cpe:2.3:a:vmware:cloud_foundation:5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3D640F9-7733-415F-8BA7-DC41658EDC76"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@vmware.com"
}