SB2023111457 - Authentication bypass in VMware Cloud Director Appliance
Published: November 14, 2023 Updated: October 25, 2024
Security Bulletin ID
SB2023111457
Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Improper Authentication (CVE-ID: CVE-2023-34060)
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to an unspecified error that occurred after upgrading from previous versions to version 10.5.0. A remote attacker can bypass login restrictions when authenticating on port 22 (ssh) or port 5480 (appliance management console) and gain unauthorized access to the appliance.
Note, the vulnerability is present only in case VMware Cloud Director Appliance was upgraded to 10.5 from an older version.
Remediation
Install update from vendor's website.