VMware の VMware Cloud Director Appliance における重要な機能に対する認証の欠如に関する脆弱性
| Title |
VMware の VMware Cloud Director Appliance における重要な機能に対する認証の欠如に関する脆弱性
|
| Summary |
VMware の VMware Cloud Director Appliance には、重要な機能に対する認証の欠如に関する脆弱性が存在します。
|
| Possible impacts |
情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。 |
| Solution |
ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date |
Nov. 14, 2023, midnight |
| Registration Date |
Jan. 10, 2024, 2:26 p.m. |
| Last Update |
Jan. 10, 2024, 2:26 p.m. |
|
CVSS3.0 : 緊急
|
| Score |
9.8
|
| Vector |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected System
| VMware |
|
VMware Cloud Director Appliance 10.5 未満
|
CVE (情報セキュリティ 共通脆弱性識別子)
CWE (共通脆弱性タイプ一覧)
ベンダー情報
Change Log
| No |
Changed Details |
Date of change |
| 1 |
[2024年01月09日] 掲載 |
Jan. 9, 2024, 3:35 p.m. |
NVD Vulnerability Information
CVE-2023-34060
| Summary |
VMware Cloud Director Appliance contains an authentication bypass vulnerability in case VMware Cloud Director Appliance was upgraded to 10.5 from
an older version. On an upgraded version of VMware Cloud Director Appliance 10.5, a malicious actor with network access to the appliance can bypass login
restrictions when authenticating on port 22 (ssh) or port 5480 (appliance management console) . This bypass is not present on port 443 (VCD provider
and tenant login). On a new installation of VMware Cloud Director Appliance 10.5, the bypass is not present. VMware Cloud Director Appliance is impacted since it uses an affected version of sssd from the underlying Photon OS. The sssd issue is no longer present in versions of Photon OS that ship with sssd-2.8.1-11 or higher (Photon OS 3) or sssd-2.8.2-9 or higher (Photon OS 4 and 5).
|
| Publication Date |
Nov. 15, 2023, 6:15 a.m. |
| Registration Date |
Nov. 15, 2023, 10 a.m. |
| Last Update |
Nov. 21, 2024, 5:06 p.m. |
Affected software configurations
| Configuration1 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:vmware:cloud_director:*:*:*:*:*:*:*:* |
|
|
|
10.5 |
| execution environment |
| 1 |
cpe:2.3:o:vmware:photon_os:-:*:*:*:*:*:*:* |
Related information, measures and tools
Common Vulnerabilities List