CVE-2023-20887: Vmware Aria Operations for Networks Command Injection Vulnerability

Vulnerability summary

CVE-2023-20887 is a critical (CVSS 9.8) Command Injection vulnerability in VMware Aria Operations for Networks. It is known to be exploited: CISA lists it, first on 22-06-2023. EPSS estimates a 98.28% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 07-06-2023
   PublishedVulnerability first disclosed.
2. 22-06-2023
   Added to CISA KEVVmware Aria Operations for Networks Command Injection Vulnerability
3. 13-07-2023
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.

• CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.