CVE-2023-34051

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

VMware Aria Operations for Logs contains an authentication bypass vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
n/a	VMware Aria Operations for Logs	VMware Aria Operations for Logs 8.x, VMware Cloud Foundation (VMware Aria Operations for Logs) 5.x 4.x

References

https://www.vmware.com/security/advisories/VMSA-2023-0021.htmlPatch, Vendor Advisory
https://www.vmware.com/security/advisories/VMSA-2023-0021.htmlPatch, Vendor Advisory

Timeline

Published: Oct 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-340527.8VMware Aria Operations for Logs contains a deserialization vulnerability. A malicious actor with non-administrative access to the local syst CVE-2023-340537.5In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of CVE-2023-340547.5In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specia CVE-2023-340556.5In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests t CVE-2023-340564.3vCenter Server contains a partial information disclosure vulnerability. A malicious actor with non-administrative privileges to vCenter Serv CVE-2023-340577.8VMware Tools contains a local privilege escalation vulnerability. A malicious actor with local user access to a guest virtual machine may el CVE-2023-340587.5VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https CVE-2023-340597.0open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. A malicious actor with non-root privileges ma CVE-2023-34066.5Path Traversal issue in M-Files Classic Web versions below 23.6.12695.3 and LTS Service Release Versions before 23.2 LTS SR3 allows authenti CVE-2023-340609.8VMware Cloud Director Appliance contains an authentication bypass vulnerability in case VMware Cloud Director Appliance was upgraded to 10.5 CVE-2023-340617.5Cloud Foundry routing release versions from v0.163.0 to v0.283.0 are vulnerable to a DOS attack. An unauthenticated attacker can use this v CVE-2023-340627.5In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a