VMSA-2023-0005:VMware vRealize Orchestrator update addresses an XML External Entity (XXE) vulnerability

Product/Component

VCF Operations/Automation (formerly VMware Aria Suite)

1 more products

Notification Id

23668

Last Updated

19 February 2023

Initial Publication Date

19 February 2023

Status

CLOSED

Severity

HIGH

CVSS Base Score

8.8

WorkAround

Affected CVE

CVE-2023-20855

Advisory ID: VMSA-2023-0005

CVSSv3 Range: 8.8

Issue Date:2023-02-21

Updated On: 2023-02-21 (Initial Advisory)

CVE(s): CVE-2023-20855

Synopsis: VMware vRealize Orchestrator update addresses an XML External Entity (XXE) vulnerability (CVE-2023-20855)

1. Impacted Products

VMware vRealize Orchestrator
VMware vRealize Automation
VMware Cloud Foundation (Cloud Foundation)

2. Introduction

An XML External Entity (XXE) vulnerability affecting VMware vRealize Orchestrator was privately reported to VMware. Updates are available to address this vulnerability in affected VMware products.

3. XML External Entity (XXE) Vulnerability (CVE-2023-20855)

Description

VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.8.

Known Attack Vectors

A malicious actor, with non-administrative access to vRealize Orchestrator, may be able to use specially crafted input to bypass XML parsing restrictions leading to access to sensitive information or possible escalation of privileges.

Resolution

To remediate CVE-2023-20855 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' below.

Workarounds

None.

Additional Documentation

None.

Notes

VMware vRealize Automation 8.x is affected since it uses embedded vRealize Orchestrator.

Acknowledgements

VMware would like to thank IT.NRW for reporting this issue to us.

Response Matrix

Product	Version	Running On	CVE Identifier	CVSSv3	Severity	Fixed Version	Workarounds	Additional Documentation
VMware vRealize Orchestrator	8.x	Virtual Appliance	CVE-2023-20855	8.8	important	8.11.1	None	None
VMware vRealize Automation	8.x	Any	CVE-2023-20855	8.8	important	8.11.1	None	None

Impacted Product Suites that Deploy Response Matrix Components:

Product	Version	Running On	CVE Identifier	CVSSv3	Severity	Fixed Version	Workarounds	Additional Documentation
VMware Cloud Foundation (vRealize Automation)	4.x	Any	CVE-2023-20855	8.8	important	KB90926	None	None