XXE vulnerability affecting VMware vRealize Orchestrator [CB10117]

Source: https://www.vmware.com/security/advisories/VMSA-2023-0005.html Tip Upgrade your vRO/vRA to version 8.11.1 as soon as possible to overcome this vulnerability. Impacted Products Introduction An XML External Entity (XXE) vulnerability affecting VMware vRealize Orchestrator was privately reported to VMware. Updates are available to address this vulnerability in affected VMware products. 3. XML External Entity (XXE) Vulnerability (CVE-2023-20855) Description VMware…

By

min read

XXE vulnerability affecting VMware vRealize Orchestrator [CB10117]

Source: https://www.vmware.com/security/advisories/VMSA-2023-0005.html


Tip Upgrade your vRO/vRA to version 8.11.1 as soon as possible to overcome this vulnerability.


Impacted Products

  • VMware vRealize Orchestrator
  • VMware vRealize Automation
  • VMware Cloud Foundation (Cloud Foundation) 

Introduction

An XML External Entity (XXE) vulnerability affecting VMware vRealize Orchestrator was privately reported to VMware. Updates are available to address this vulnerability in affected VMware products.

3. XML External Entity (XXE) Vulnerability (CVE-2023-20855)

Description

VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.8.

Known Attack Vectors

A malicious actor, with non-administrative access to vRealize Orchestrator, may be able to use specially crafted input to bypass XML parsing restrictions leading to access to sensitive information or possible escalation of privileges.

Resolution

To remediate CVE-2023-20855 apply the patches listed in the ‘Fixed Version’ column of the ‘Response Matrix’ below.

Workarounds

None.

Additional Documentation

None.

Notes

VMware vRealize Automation 8.x is affected since it uses embedded vRealize Orchestrator.

Acknowledgements

VMware would like to thank IT.NRW for reporting this issue to us.

Response Matrix

ProductVersionRunning OnCVE IdentifierCVSSv3SeverityFixed VersionWorkaroundsAdditional Documentation
VMware vRealize Orchestrator8.xVirtual ApplianceCVE-2023-208558.8Important 8.11.1NoneNone
VMware vRealize Automation8.xAnyCVE-2023-208558.8Important 8.11.1NoneNone

Impacted Product Suites that Deploy Response Matrix Components:

ProductVersionRunning OnCVE IdentifierCVSSv3SeverityFixed VersionWorkaroundsAdditional Documentation
VMware Cloud Foundation (vRealize Automation)4.xAnyCVE-2023-208558.8Important KB90926NoneNone

References

GitHub Advisory DB: https://github.com/advisories/GHSA-3hq4-5qpg-7776

NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-20855

Hacker News: https://thehackernews.com/2023/02/vmware-patches-critical-vulnerability.html

Securoty Online: https://securityonline.info/vmware-patches-critical-cve-2023-20858-vulnerability-in-carbon-black-app-control/

Cloud Foundation (vRealize Automation) KB90926: https://kb.vmware.com/s/article/90926

Mitre CVE Dictionary Links:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20855

FIRST CVSSv3 Calculator:
https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Change Log

2023-02-21 VMSA-2023-0005

Initial security advisory. 

Contact

E-mail: security@vmware.com

PGP key at:
https://kb.vmware.com/kb/1055 

VMware Security Advisories
https://www.vmware.com/security/advisories 

VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html 

VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html 

VMware Security & Compliance Blog  
https://blogs.vmware.com/security 

Twitter
https://twitter.com/VMwareSRC

Leave a Reply

Related Posts

%d bloggers like this: