What’s Vulnerable › Vulnerabilities

CVE-2023-20890

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 20.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-08-29 · updated 2026-06-17
• Weakness: CWE-22

Description

Aria Operations for Networks contains an arbitrary file write vulnerability. An authenticated malicious actor with administrative access to VMware Aria Operations for Networks can write files to arbitrary locations resulting in remote code execution.

Affected products

• VMware Aria Operations for Networks: from 6.2.0 before 6.11.0 — fixed in 6.11.0
• Aria Operations for Networks: Aria Operations for Networks 6.x

How to fix

Upgrade to a fixed version: VMware Aria Operations for Networks 6.11.0. Check the vendor advisory for mitigations.

References

• https://www.vmware.com/security/advisories/VMSA-2023-0018.html
• https://www.vmware.com/security/advisories/VMSA-2023-0018.html

Get alerted when CVE-2023-20890 or the next vulnerability affects your stack