Source: https://www.vmware.com/security/advisories/VMSA-2023-0005.html

---

Tip Upgrade your vRO/vRA to version 8.11.1 as soon as possible to overcome this vulnerability.

---

1. Impacted Products
2. Introduction
3. 3. XML External Entity (XXE) Vulnerability (CVE-2023-20855)
   1. Description
   2. Known Attack Vectors
   3. Resolution
   4. Workarounds
   5. Additional Documentation
   6. Notes
   7. Acknowledgements
   8. Response Matrix
   9. Impacted Product Suites that Deploy Response Matrix Components:
4. References
5. Change Log
6. Contact

Impacted Products

• VMware vRealize Orchestrator
• VMware vRealize Automation
• VMware Cloud Foundation (Cloud Foundation) 

Introduction

An XML External Entity (XXE) vulnerability affecting VMware vRealize Orchestrator was privately reported to VMware. Updates are available to address this vulnerability in affected VMware products.

3. XML External Entity (XXE) Vulnerability (CVE-2023-20855)

Description

VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.8.

Known Attack Vectors

A malicious actor, with non-administrative access to vRealize Orchestrator, may be able to use specially crafted input to bypass XML parsing restrictions leading to access to sensitive information or possible escalation of privileges.

Resolution

To remediate CVE-2023-20855 apply the patches listed in the ‘Fixed Version’ column of the ‘Response Matrix’ below.

Workarounds

None.

Additional Documentation

None.

Notes

VMware vRealize Automation 8.x is affected since it uses embedded vRealize Orchestrator.

Acknowledgements

VMware would like to thank IT.NRW for reporting this issue to us.

Response Matrix

Product	Version	Running On	CVE Identifier	CVSSv3	Severity	Fixed Version	Workarounds	Additional Documentation
VMware vRealize Orchestrator	8.x	Virtual Appliance	CVE-2023-20855	8.8	Important	8.11.1	None	None
VMware vRealize Automation	8.x	Any	CVE-2023-20855	8.8	Important	8.11.1	None	None

Impacted Product Suites that Deploy Response Matrix Components:

Product	Version	Running On	CVE Identifier	CVSSv3	Severity	Fixed Version	Workarounds	Additional Documentation
VMware Cloud Foundation (vRealize Automation)	4.x	Any	CVE-2023-20855	8.8	Important	KB90926	None	None

References

GitHub Advisory DB: https://github.com/advisories/GHSA-3hq4-5qpg-7776

NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-20855

Hacker News: https://thehackernews.com/2023/02/vmware-patches-critical-vulnerability.html

Securoty Online: https://securityonline.info/vmware-patches-critical-cve-2023-20858-vulnerability-in-carbon-black-app-control/

Cloud Foundation (vRealize Automation) KB90926: https://kb.vmware.com/s/article/90926

Mitre CVE Dictionary Links:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20855

FIRST CVSSv3 Calculator:
https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Change Log

2023-02-21 VMSA-2023-0005

Initial security advisory. 

Contact

E-mail: security@vmware.com

PGP key at:
https://kb.vmware.com/kb/1055 

VMware Security Advisories
https://www.vmware.com/security/advisories 

VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html 

VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html 

VMware Security & Compliance Blog  
https://blogs.vmware.com/security 

Twitter
https://twitter.com/VMwareSRC