VMSA-2023-0015:VMware SD-WAN update addresses a bypass authentication vulnerability
23661
10 July 2023
04 July 2023
CLOSED
MEDIUM
5.3
CVE-2023-20899
1. Impacted Products
VMware SD-WAN (Edge)
2. Introduction
An Authentication Bypass Vulnerability affecting VMware SD-WAN was privately reported to VMware. Updates are available to address this vulnerability in affected VMware products.
3. VMware SD-WAN Bypass Authentication Vulnerability (CVE-2023-20899)
Description
VMware SD-WAN contains a bypass authentication vulnerability. VMware has evaluated the severity of this issue to be in the moderate severity range with a maximum CVSSv3 base score of 5.3.
Known Attack Vectors
A malicious actor with network access to the Edge Local Web UI can download an Edge Diagnostic bundle of the application without authentication. Local Web UI Access is disabled by default.
Resolution
To remediate CVE-2023-20899 apply the updates listed in the 'Fixed Version' column of the 'Response Matrix' below.
Workarounds
None
Additional Documentation
By default access to the Edge local UI is disabled. VMware recommends leaving the Local Web UI disabled. Instructions on disabling the Local Web UI after it has been manually enabled can be found in the VMware SD-WAN Product Documentation. Following the Hardening Guidelines will prevent this vulnerability from being exploited. (Velocloud Security Hardening Guidelines)
Notes
This vulnerability affects Edge devices only and not the SD-WAN management console (VCO)
Acknowledgements
VMware would like to thank Marco Bruinenberg of Accenture for reporting this issue to us.
Response Matrix
| Product | Version | Running On | CVE Identifier | CVSSv3 | Severity | Fixed Version | Workarounds | Additional Documentation |
| VMware SD-WAN (Edge) | 5.x.x | Any | CVE-2023-20899 | N/A | N/A | Unaffected | N/A | N/A |
| VMware SD-WAN (Edge) | 4.5.x | Any | CVE-2023-20899 | moderate | None |
4. References
Fixed Version(s) and Release Notes:
VMware SD-WAN 4.5.2 Release Notes: https://docs.vmware.com/en/VMware-SASE/4.5.2/rn/vmware-sase-452-release-notes/index.html
Downloads and Documentation:
https://customerconnect.vmware.com/en/downloads/info/slug/networking_security/vmware_sd_wan/4_5_2
Mitre CVE Dictionary Links:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20899
FIRST CVSSv3 Calculator:
CVE-2023-20899: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
5. Change Log
2023-07-06 VMSA-2023-0015
Initial security advisory.
2023-07-12 VMSA-2023-0015
Updated to add the Velocloud Security Hardening Guidelines
6. Contact
E-mail list for product security notifications and announcements:
https://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
E-mail: [email protected]
PGP key at:
VMware Security Advisories
https://www.vmware.com/security/advisories
VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html
VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html
VMware Security & Compliance Blog
https://blogs.vmware.com/security
Copyright 2023 VMware Inc. All rights reserved.