CVE-2023-20867

LowCVSS 3.9/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.

Metrics

CVSS 3.1 3.9/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-287

Affected software

VendorProductVersions
VMwareVMware Tools—

References

Timeline

Published
Jun 13, 2023
Last modified
Jun 17, 2026
Added to CISA KEV
Jun 23, 2023
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-208686.1NSX-T contains a reflected cross-site scripting vulnerability due to a lack of input validation. A remote attacker can inject HTML or JavaScCVE-2023-208698.2VMware Workstation (17.x) and VMware Fusion (13.x) contain a stack-based buffer-overflow vulnerability that exists in the functionality for CVE-2023-20874.3The Essential Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.0.6. This is due tCVE-2023-208706.0VMware Workstation and Fusion contain an out-of-bounds read vulnerability that exists in the functionality for sharing host Bluetooth deviceCVE-2023-208717.8VMware Fusion contains a local privilege escalation vulnerability. A malicious actor with read/write access to the host operating system canCVE-2023-208728.8VMware Workstation and Fusion contain an out-of-bounds read/write vulnerability in SCSI CD/DVD device emulation.CVE-2023-208739.8In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry coulCVE-2023-208778.8VMware Aria Operations contains a privilege escalation vulnerability. An authenticated malicious user with ReadOnly privileges can perform cCVE-2023-208787.2VMware Aria Operations contains a deserialization vulnerability. A malicious actor with administrative privileges can execute arbitrary commCVE-2023-208796.7VMware Aria Operations contains a Local privilege escalation vulnerability. A malicious actor with administrative privileges in the Aria OpeCVE-2023-20886.5A flaw was found in OpenStack due to an inconsistency between Cinder and Nova. This issue can be triggered intentionally or by accident. A rCVE-2023-208806.7VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with administrative access to the local system can e