VMSA-2023-0003:VMware Workstation update addresses an arbitrary file deletion vulnerability

VMware Tanzu Application Service

0 more products

23659

31 January 2023

31 January 2023

CLOSED

HIGH

7.8

CVE-2023-20854

VMSA-2023-0003
7.8
2023-02-02
2023-02-02 (Initial Advisory)
CVE-2023-20854
VMware Workstation update addresses an arbitrary file deletion vulnerability (CVE-2023-20854)
1. Impacted Products

  • VMware Workstation

2. Introduction

An arbitrary file deletion vulnerability in VMware Workstation was privately reported to VMware. Updates are available to remediate this vulnerability in the affected VMware product.

3. Arbitrary file deletion vulnerability (CVE-2023-20854)

Description

VMware Workstation contains an arbitrary file deletion vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.8.

Known Attack Vectors

A malicious actor with local user privileges on the victim's machine may exploit this vulnerability to delete arbitrary files from the file system of the machine on which Workstation is installed.

Resolution

To remediate CVE-2023-20854 update to the version listed in the 'Fixed Version' column of the 'Response Matrix' found below.

Workarounds

None.

Additional Documentation

None.

Notes

None.

Acknowledgements

VMware would like to thank Frederik Reiter of cirosec GmbH for reporting this issue to us.

Response Matrix

Product Version Running On CVE Identifier CVSSv3 Severity Fixed Version Workarounds Additional Documentation
VMware Workstation
17.x
Windows
CVE-2023-20854
important
17.0.1
None
None
4. References
5. Change Log

2023-02-02 VMSA-2023-0003
Initial security advisory.

6. Contact

E-mail: [email protected]

PGP key at:
https://kb.vmware.com/kb/1055 

VMware Security Advisories
https://www.vmware.com/security/advisories 

VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html 

VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html 

VMware Security & Compliance Blog  
https://blogs.vmware.com/security 

Twitter
https://twitter.com/VMwareSRC

Copyright 2023 VMware Inc. All rights reserved.