NetSight
IP …
high7.1

CVE-2023-20900

A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-…

Impact

A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html  in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .

Affected products

VendorProductAffected versions
VmwareTools
from 10.3.0 before 12.3.0
from 10.3.0 before 10.3.26
VmwareOpen Vm Tools
from 10.3.0 before 12.3.0
FedoraprojectFedora
Versions 37, 38, 39
DebianDebian Linux
Versions 10.0, 11.0, 12.0
NetappOntap Select Deploy Administration Utility
All versions

Weakness classification

CWE-294

References