CVE-2023-20888

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Aria Operations for Networks contains an authenticated deserialization vulnerability. A malicious actor with network access to VMware Aria Operations for Networks and valid 'member' role credentials may be able to perform a deserialization attack resulting in remote code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

VendorProductVersions
n/aAria Operations for Networks (Formerly vRealize Network Insight)Aria Operations for Networks (Formerly vRealize Network Insight) 6.x

References

Timeline

Published
Jun 7, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-208897.5Aria Operations for Networks contains an information disclosure vulnerability. A malicious actor with network access to VMware Aria OperatioCVE-2023-20898.8A vulnerability was found in SourceCodester Complaint Management System 1.0. It has been rated as critical. This issue affects some unknown CVE-2023-208907.2Aria Operations for Networks contains an arbitrary file write vulnerability. An authenticated malicious actor with administrative access to CVE-2023-208916.5The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of creCVE-2023-208929.8The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protoCVE-2023-208939.8The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol. A malicious actor with netwoCVE-2023-208949.8The VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor withCVE-2023-208959.8The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol. A malicious actor with neCVE-2023-208967.5The VMware vCenter Server contains an out-of-bounds read vulnerability in the implementation of the DCERPC protocol. A malicious actor with CVE-2023-208975.3Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to thCVE-2023-208987.8Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 300CVE-2023-208997.5VMware SD-WAN (Edge) contains a bypass authentication vulnerability. An unauthenticated attacker can download the Diagnostic bundle of the a