VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity
Files
c1444140e59c61ba154436ea0cd6284d8a97c3f0
vuln-cve/data/2023/34xxx/CVE-2023-34058.json
T

237 lines
10 KiB
JSON
Raw Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"cveMetadata": {
"cveId": "CVE-2023-34058",
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"state": "PUBLISHED",
"assignerShortName": "vmware",
"dateReserved": "2023-05-25T17:21:56.204Z",
"datePublished": "2023-10-27T04:53:09.935Z",
"dateUpdated": "2025-03-06T15:40:20.221Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "VMware Tools",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "12.x.x"
},
{
"status": "affected",
"version": "11.x.x"
},
{
"status": "affected",
"version": "10.3.x"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "open-vm-tools",
"vendor": "n/a",
"versions": [
{
"lessThanOrEqual": "12.3.0",
"status": "affected",
"version": "11.0.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "VMware Tools contains a SAML token signature bypass vulnerability.&nbsp;A malicious actor that has been granted <a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html\">Guest Operation Privileges</a>&nbsp;in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged <a target=\"_blank\" rel=\"nofollow\" href=\"https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html\">Guest Alias</a>."
}
],
"value": "VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html  in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html ."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "SAML Token Signature Bypass vulnerability",
"lang": "en"
}
]
}
],
"providerMetadata": {
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware",
"dateUpdated": "2023-11-17T04:34:05.439Z"
},
"references": [
{
"url": "https://www.vmware.com/security/advisories/VMSA-2023-0024.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2023/10/27/1"
},
{
"url": "https://www.debian.org/security/2023/dsa-5543"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00002.html"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLTKVTRKQW2GD2274H3UOW6XU4E62GSK/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G7G77Z76CQPGUF7VHRA6O3UFCMPPR4O2/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQUOFQL2SNNNMKROQ3TZQY4HEYMNOIBW/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
},
"adp": [
{
"providerMetadata": {
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE",
"dateUpdated": "2024-08-02T16:01:52.447Z"
},
"title": "CVE Program Container",
"references": [
{
"url": "https://www.vmware.com/security/advisories/VMSA-2023-0024.html",
"tags": [
"x_transferred"
]
},
{
"url": "http://www.openwall.com/lists/oss-security/2023/10/27/1",
"tags": [
"x_transferred"
]
},
{
"url": "https://www.debian.org/security/2023/dsa-5543",
"tags": [
"x_transferred"
]
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00002.html",
"tags": [
"x_transferred"
]
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLTKVTRKQW2GD2274H3UOW6XU4E62GSK/",
"tags": [
"x_transferred"
]
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G7G77Z76CQPGUF7VHRA6O3UFCMPPR4O2/",
"tags": [
"x_transferred"
]
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQUOFQL2SNNNMKROQ3TZQY4HEYMNOIBW/",
"tags": [
"x_transferred"
]
}
]
},
{
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-347",
"lang": "en",
"description": "CWE-347 Improper Verification of Cryptographic Signature"
}
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2025-03-06T15:26:48.404064Z",
"id": "CVE-2023-34058",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2025-03-06T15:40:20.221Z"
}
}
]
}
}
View Git Blame Copy Permalink