VMSA-2023-0005:VMware vRealize Orchestrator update addresses an XML External Entity (XXE) vulnerability

VMware Tanzu Application Service

0 more products

23668

19 February 2023

19 February 2023

CLOSED

HIGH

8.8

CVE-2023-20855

VMSA-2023-0005
8.8
2023-02-21
2023-02-21 (Initial Advisory)
CVE-2023-20855
VMware vRealize Orchestrator update addresses an XML External Entity (XXE) vulnerability (CVE-2023-20855)
1. Impacted Products
 
  • VMware vRealize Orchestrator
  • VMware vRealize Automation
  • VMware Cloud Foundation (Cloud Foundation) 

 

 

2. Introduction

An XML External Entity (XXE) vulnerability affecting VMware vRealize Orchestrator was privately reported to VMware. Updates are available to address this vulnerability in affected VMware products.

3. XML External Entity (XXE) Vulnerability (CVE-2023-20855)

Description

VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.8.

Known Attack Vectors

A malicious actor, with non-administrative access to vRealize Orchestrator, may be able to use specially crafted input to bypass XML parsing restrictions leading to access to sensitive information or possible escalation of privileges.

Resolution

To remediate CVE-2023-20855 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' below.

Workarounds

None.

Additional Documentation

None.

Notes

VMware vRealize Automation 8.x is affected since it uses embedded vRealize Orchestrator.

Acknowledgements

VMware would like to thank IT.NRW for reporting this issue to us.

Response Matrix

Product Version Running On CVE Identifier CVSSv3 Severity Fixed Version Workarounds Additional Documentation
VMware vRealize Orchestrator
8.x
Virtual Appliance
CVE-2023-20855
None
None
VMware vRealize Automation
8.x
Any
CVE-2023-20855
None
None

Impacted Product Suites that Deploy Response Matrix Components:

Product Version Running On CVE Identifier CVSSv3 Severity Fixed Version Workarounds Additional Documentation
VMware Cloud Foundation (vRealize Automation)
4.x
Any
CVE-2023-20855
important
None
None
4. References
5. Change Log

2023-02-21 VMSA-2023-0005

Initial security advisory. 

 

6. Contact

E-mail: [email protected]

PGP key at:
https://kb.vmware.com/kb/1055 

VMware Security Advisories
https://www.vmware.com/security/advisories 

VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html 

VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html 

VMware Security & Compliance Blog  
https://blogs.vmware.com/security 

Twitter
https://twitter.com/VMwareSRC

Copyright 2023 VMware Inc. All rights reserved.