VMware has released security updates to fix a trio of flaws in Aria Operations for Networks that could result in information disclosure and remote code execution.
The most critical of the three vulnerabilities is a command injection vulnerability tracked as CVE-2023-20887 (CVSS score: 9.8) that could allow a malicious actor with network access to achieve remote code execution.
Also patched by VMware is another deserialization vulnerability (CVE-2023-20888) that’s rated 9.1 out of a maximum of 10 on the CVSS scoring system.
The third security defect is a high-severity information disclosure bug (CVE-2023-20889, CVSS score: 8.8) that could permit an actor with network access to perform a command injection attack and obtain access to sensitive data.
The three shortcomings, which impact VMware Aria Operations Networks version 6.x, have been remediated in the following versions: 6.2, 6.3, 6.4, 6.5.1, 6.6, 6.7, 6.8, 6.9, and 6.10. There are no workarounds that mitigate the issues.
The alert comes as Cisco shipped fixes for a critical flaw in its Expressway Series and TelePresence Video Communication Server (VCS) that could “allow an authenticated attacker with Administrator-level read-only credentials to elevate their privileges to Administrator with read-write credentials on an affected system.”
While there is no evidence that any of the aforementioned flaws have been abused in the wild, it’s highly advised to patch the vulnerabilities as soon as possible to mitigate potential risks.
The advisories also follow the discovery of three security bugs in RenderDoc (CVE-2023-33863, CVE-2023-33864, and CVE-2023-33865), an open-source graphics debugger, that could allow an advisory to gain elevated privileges and execute arbitrary code.
Source: https://thehackernews.com/
