Vulnerability-Lookup

CVE-2023-20867 (GCVE-0-2023-20867)

Vulnerability from cvelistv5 – Published: 2023-06-13 16:47 – Updated: 2025-10-21 23:05

CISA Previdian

Title

VMware Tools Authentication Bypass Vulnerability

Summary

A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.

Severity

3.9 (Low)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

SSVC

Exploitation: active Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-04 19:00 UTC

CWE

CWE-287 - Improper Authentication

Assigner

vmware mitre root

References

10 references

URL	Tags
https://www.vmware.com/security/advisories/VMSA-2…
https://security.netapp.com/advisory/ntap-2023072…
https://lists.debian.org/debian-lts-announce/2023…
https://www.debian.org/security/2023/dsa-5493
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
http://www.openwall.com/lists/oss-security/2023/10/16/2
http://www.openwall.com/lists/oss-security/2023/1…
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Impacted products

1 product

Vendor	Product	Version	CPE status
VMware	VMware Tools	Unaffected: 12.2.5	guessed

CISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: a4a5f309-3149-4b71-aa53-5e75cd8d6d6d

Vulnerability ID: CVE-2023-20867

Status: Confirmed

Status Updated: 2023-06-23 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2023-06-23

Asserted: 2023-06-23

Scope

Notes: KEV entry: VMware Tools Authentication Bypass Vulnerability | Affected: VMware / Tools | Description: VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access over ESXi to exploit this vulnerability. | Required action: Apply updates per vendor instructions. | Due date: 2023-07-14 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.vmware.com/security/advisories/VMSA-2023-0013.html; https://nvd.nist.gov/vuln/detail/CVE-2023-20867

Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details

Cwes	CWE-287
Feed	CISA Known Exploited Vulnerabilities Catalog
Product	Tools
Due Date	2023-07-14
Date Added	2023-06-23
Vendorproject	VMware
Vulnerabilityname	VMware Tools Authentication Bypass Vulnerability
Knownransomwarecampaignuse	Unknown

References

CVE-2023-20867

Created: 2026-02-02 12:26 UTC | Updated: 2026-02-06 07:17 UTC

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 6171be60-7107-435f-b922-b210619c1709

Vulnerability ID: CVE-2023-20867

Status: Confirmed

Status Updated: 2023-06-23 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2023-06-23

Asserted: 2023-06-23

Scope

Notes: KEVIntel entry: VMware Tools Authentication Bypass Vulnerability | Affected: VMware / VMware Tools | CVSS: 3.9 (LOW) | Used in malware: unknown | Not yet in CISA KEV: False

Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: kevintel

Details

Feed	KEVIntel (kevintel.com)
Title	VMware Tools Authentication Bypass Vulnerability
Vendor	VMware
Product	VMware Tools
Added Date	2023-06-23T00:00:00.000Z
Cvss Score	3.9
Epss Score	None
Cvss Severity	LOW
Epss Percentile	None
Used In Malware	unknown
Ahead Of Cisa Kev	None
Not Yet In Cisa Kev	False

References

Created: 2026-06-23 14:05 UTC | Updated: 2026-07-10 06:14 UTC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T09:21:33.524Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.vmware.com/security/advisories/VMSA-2023-0013.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230725-0001/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00020.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5493"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZJM6HDRQYS74JA7YNKQBFH2XSZ52HEWH/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NVKQ6Y2JFJRWPFOZUOTFO3H27BK5GGOG/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJNJMD67QIT6LXLKWSHFM47DCLRSMT6W/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/10/16/2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/10/16/11"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-20867",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-04T19:00:03.914893Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2023-06-23",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20867"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:05:46.160Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20867"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2023-06-23T00:00:00.000Z",
            "value": "CVE-2023-20867 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux"
          ],
          "product": "VMware Tools",
          "vendor": "VMware",
          "versions": [
            {
              "status": "unaffected",
              "version": "12.2.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine."
            }
          ],
          "value": "A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.9,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-16T17:06:26.274Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://www.vmware.com/security/advisories/VMSA-2023-0013.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230725-0001/"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00020.html"
        },
        {
          "url": "https://www.debian.org/security/2023/dsa-5493"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZJM6HDRQYS74JA7YNKQBFH2XSZ52HEWH/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NVKQ6Y2JFJRWPFOZUOTFO3H27BK5GGOG/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJNJMD67QIT6LXLKWSHFM47DCLRSMT6W/"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2023/10/16/2"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2023/10/16/11"
        }
      ],
      "source": {
        "advisory": "VMSA-2023-0013",
        "discovery": "EXTERNAL"
      },
      "title": "VMware Tools Authentication Bypass Vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2023-20867",
    "datePublished": "2023-06-13T16:47:21.689Z",
    "dateReserved": "2022-11-01T15:41:50.390Z",
    "dateUpdated": "2025-10-21T23:05:46.160Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2023-20867",
      "cwes": [
        "CWE-287"
      ],
      "dateAdded": "2023-06-23",
      "dueDate": "2023-07-14",
      "forensicTriage": "No",
      "knownRansomwareCampaignUse": "Unknown",
      "notes": "https://www.vmware.com/security/advisories/VMSA-2023-0013.html;  https://nvd.nist.gov/vuln/detail/CVE-2023-20867",
      "product": "Tools",
      "requiredAction": "Apply updates per vendor instructions.",
      "shortDescription": "VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access over ESXi to exploit this vulnerability.",
      "vendorProject": "VMware",
      "vulnerabilityName": "VMware Tools Authentication Bypass Vulnerability"
    },
    "epss": {
      "cve": "CVE-2023-20867",
      "date": "2026-09-18",
      "epss": "0.1353",
      "percentile": "0.96269"
    },
    "fkie_nvd": {
      "cisaActionDue": "2023-07-14",
      "cisaExploitAdd": "2023-06-23",
      "cisaRequiredAction": "Apply updates per vendor instructions.",
      "cisaVulnerabilityName": "VMware Tools Authentication Bypass Vulnerability",
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vmware:tools:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "7E0027C7-536C-42DC-A0FA-7215968B3E1B",
                  "versionEndExcluding": "12.2.5",
                  "versionStartIncluding": "10.3.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "46D69DCC-AE4D-4EA5-861C-D60951444C6C",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E30D0E6F-4AE8-4284-8716-991DFA48CC5D",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*",
                  "matchCriteriaId": "CC559B26-5DFC-4B7A-A27C-B77DE755DFF9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*",
                  "matchCriteriaId": "B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine."
        },
        {
          "lang": "es",
          "value": "Un host ESXi totalmente comprometido puede obligar a VMware Tools a no poder autenticar las operaciones de host a invitado, lo que afecta la confidencialidad y la integridad de la m\u00e1quina virtual invitada."
        }
      ],
      "id": "CVE-2023-20867",
      "lastModified": "2024-11-21T07:41:43.433",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 3.9,
              "baseSeverity": "LOW",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 0.8,
            "impactScore": 2.7,
            "source": "security@vmware.com",
            "type": "Secondary"
          },
          {
            "cvssData": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 3.9,
              "baseSeverity": "LOW",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 0.8,
            "impactScore": 2.7,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2023-06-13T17:15:14.070",
      "references": [
        {
          "source": "security@vmware.com",
          "tags": [
            "Mailing List",
            "Patch"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2023/10/16/11"
        },
        {
          "source": "security@vmware.com",
          "tags": [
            "Mailing List",
            "Patch"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2023/10/16/2"
        },
        {
          "source": "security@vmware.com",
          "tags": [
            "Mailing List",
            "Third Party Advisory"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00020.html"
        },
        {
          "source": "security@vmware.com",
          "tags": [
            "Mailing List",
            "Release Notes"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NVKQ6Y2JFJRWPFOZUOTFO3H27BK5GGOG/"
        },
        {
          "source": "security@vmware.com",
          "tags": [
            "Mailing List",
            "Release Notes"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJNJMD67QIT6LXLKWSHFM47DCLRSMT6W/"
        },
        {
          "source": "security@vmware.com",
          "tags": [
            "Mailing List",
            "Release Notes"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZJM6HDRQYS74JA7YNKQBFH2XSZ52HEWH/"
        },
        {
          "source": "security@vmware.com",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20230725-0001/"
        },
        {
          "source": "security@vmware.com",
          "tags": [
            "Mailing List",
            "Third Party Advisory"
          ],
          "url": "https://www.debian.org/security/2023/dsa-5493"
        },
        {
          "source": "security@vmware.com",
          "tags": [
            "Patch",
            "Vendor Advisory"
          ],
          "url": "https://www.vmware.com/security/advisories/VMSA-2023-0013.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Mailing List",
            "Patch"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2023/10/16/11"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Mailing List",
            "Patch"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2023/10/16/2"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Mailing List",
            "Third Party Advisory"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00020.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Mailing List",
            "Release Notes"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NVKQ6Y2JFJRWPFOZUOTFO3H27BK5GGOG/"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Mailing List",
            "Release Notes"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJNJMD67QIT6LXLKWSHFM47DCLRSMT6W/"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Mailing List",
            "Release Notes"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZJM6HDRQYS74JA7YNKQBFH2XSZ52HEWH/"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20230725-0001/"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Mailing List",
            "Third Party Advisory"
          ],
          "url": "https://www.debian.org/security/2023/dsa-5493"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch",
            "Vendor Advisory"
          ],
          "url": "https://www.vmware.com/security/advisories/VMSA-2023-0013.html"
        }
      ],
      "sourceIdentifier": "security@vmware.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-287"
            }
          ],
          "source": "security@vmware.com",
          "type": "Secondary"
        },
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-287"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "platforms": [
                  "Windows",
                  "Linux"
                ],
                "product": "VMware Tools",
                "vendor": "VMware",
                "versions": [
                  {
                    "status": "unaffected",
                    "version": "12.2.5"
                  }
                ]
              }
            ],
            "source": "security@vmware.com"
          }
        ],
        "cisaActionDue": "2023-07-14",
        "cisaExploitAdd": "2023-06-23",
        "cisaRequiredAction": "Apply updates per vendor instructions.",
        "cisaVulnerabilityName": "VMware Tools Authentication Bypass Vulnerability",
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:vmware:tools:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7E0027C7-536C-42DC-A0FA-7215968B3E1B",
                    "versionEndExcluding": "12.2.5",
                    "versionStartIncluding": "10.3.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "46D69DCC-AE4D-4EA5-861C-D60951444C6C",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E30D0E6F-4AE8-4284-8716-991DFA48CC5D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CC559B26-5DFC-4B7A-A27C-B77DE755DFF9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine."
          },
          {
            "lang": "es",
            "value": "Un host ESXi totalmente comprometido puede obligar a VMware Tools a no poder autenticar las operaciones de host a invitado, lo que afecta la confidencialidad y la integridad de la m\u00e1quina virtual invitada."
          }
        ],
        "id": "CVE-2023-20867",
        "lastModified": "2026-06-17T05:31:03.380",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 3.9,
                "baseSeverity": "LOW",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 0.8,
              "impactScore": 2.7,
              "source": "security@vmware.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 3.9,
                "baseSeverity": "LOW",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 0.8,
              "impactScore": 2.7,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-20867",
                "options": [
                  {
                    "exploitation": "active"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-04T19:00:03.914893Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2023-06-13T17:15:14.070",
        "references": [
          {
            "source": "security@vmware.com",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/10/16/11"
          },
          {
            "source": "security@vmware.com",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/10/16/2"
          },
          {
            "source": "security@vmware.com",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00020.html"
          },
          {
            "source": "security@vmware.com",
            "tags": [
              "Mailing List",
              "Release Notes"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NVKQ6Y2JFJRWPFOZUOTFO3H27BK5GGOG/"
          },
          {
            "source": "security@vmware.com",
            "tags": [
              "Mailing List",
              "Release Notes"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJNJMD67QIT6LXLKWSHFM47DCLRSMT6W/"
          },
          {
            "source": "security@vmware.com",
            "tags": [
              "Mailing List",
              "Release Notes"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZJM6HDRQYS74JA7YNKQBFH2XSZ52HEWH/"
          },
          {
            "source": "security@vmware.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230725-0001/"
          },
          {
            "source": "security@vmware.com",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5493"
          },
          {
            "source": "security@vmware.com",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://www.vmware.com/security/advisories/VMSA-2023-0013.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/10/16/11"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/10/16/2"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00020.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Release Notes"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NVKQ6Y2JFJRWPFOZUOTFO3H27BK5GGOG/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Release Notes"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJNJMD67QIT6LXLKWSHFM47DCLRSMT6W/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Release Notes"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZJM6HDRQYS74JA7YNKQBFH2XSZ52HEWH/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230725-0001/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5493"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://www.vmware.com/security/advisories/VMSA-2023-0013.html"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "US Government Resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20867"
          }
        ],
        "sourceIdentifier": "security@vmware.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-287"
              }
            ],
            "source": "security@vmware.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2025-11-21T10:34:46+00:00",
      "cve": "CVE-2023-20867",
      "id": "CVE-2023-20867",
      "initial_release_date": "2023-06-13T00:00:00+00:00",
      "product_status:fixed": "146",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "open-vm-tools: authentication bypass vulnerability in the vgauth module",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-20867.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T01:21:22Z",
      "cve": "CVE-2023-20867",
      "id": "CVE-2023-20867",
      "initial_release_date": "2023-06-09T02:32:52Z",
      "product_status:known_not_affected": "15",
      "product_status:recommended": "315",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-20867",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-20867.json",
      "version": "35"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T09:21:33.524Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://www.vmware.com/security/advisories/VMSA-2023-0013.html"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://security.netapp.com/advisory/ntap-20230725-0001/"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00020.html"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://www.debian.org/security/2023/dsa-5493"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZJM6HDRQYS74JA7YNKQBFH2XSZ52HEWH/"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NVKQ6Y2JFJRWPFOZUOTFO3H27BK5GGOG/"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJNJMD67QIT6LXLKWSHFM47DCLRSMT6W/"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "http://www.openwall.com/lists/oss-security/2023/10/16/2"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "http://www.openwall.com/lists/oss-security/2023/10/16/11"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-20867",
                    "options": [
                      {
                        "Exploitation": "active"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-02-04T19:00:03.914893Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              },
              {
                "other": {
                  "content": {
                    "dateAdded": "2023-06-23",
                    "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20867"
                  },
                  "type": "kev"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-02-04T19:00:16.288Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "government-resource"
                ],
                "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20867"
              }
            ],
            "timeline": [
              {
                "lang": "en",
                "time": "2023-06-23T00:00:00.000Z",
                "value": "CVE-2023-20867 added to CISA KEV"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "platforms": [
                "Windows",
                "Linux"
              ],
              "product": "VMware Tools",
              "vendor": "VMware",
              "versions": [
                {
                  "status": "unaffected",
                  "version": "12.2.5"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine."
                }
              ],
              "value": "A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-115",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-115 Authentication Bypass"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 3.9,
                "baseSeverity": "LOW",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-287",
                  "description": "CWE-287 Improper Authentication",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2023-10-16T17:06:26.274Z",
            "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
            "shortName": "vmware"
          },
          "references": [
            {
              "url": "https://www.vmware.com/security/advisories/VMSA-2023-0013.html"
            },
            {
              "url": "https://security.netapp.com/advisory/ntap-20230725-0001/"
            },
            {
              "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00020.html"
            },
            {
              "url": "https://www.debian.org/security/2023/dsa-5493"
            },
            {
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZJM6HDRQYS74JA7YNKQBFH2XSZ52HEWH/"
            },
            {
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NVKQ6Y2JFJRWPFOZUOTFO3H27BK5GGOG/"
            },
            {
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJNJMD67QIT6LXLKWSHFM47DCLRSMT6W/"
            },
            {
              "url": "http://www.openwall.com/lists/oss-security/2023/10/16/2"
            },
            {
              "url": "http://www.openwall.com/lists/oss-security/2023/10/16/11"
            }
          ],
          "source": {
            "advisory": "VMSA-2023-0013",
            "discovery": "EXTERNAL"
          },
          "title": "VMware Tools Authentication Bypass Vulnerability",
          "x_generator": {
            "engine": "Vulnogram 0.1.0-dev"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "assignerShortName": "vmware",
        "cveId": "CVE-2023-20867",
        "datePublished": "2023-06-13T16:47:21.689Z",
        "dateReserved": "2022-11-01T15:41:50.390Z",
        "dateUpdated": "2025-10-21T23:05:46.160Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

OESA-2023-1629 (CVE-2023-20867)

Vulnerability from osv_openeuler – Published: 2023-09-15 11:06 – Updated: 2026-08-06 11:06 – Source website

CISA Previdian

Summary

open-vm-tools security update

Details

The project is an open source implementation of VMware Tools. It is a suite of open source virtualization utilities and drivers to improve the functionality, user experience and administration of VMware virtual machines. This package contains only the core user-space programs and libraries of .

Security Fix(es):

A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.(CVE-2023-20867)

A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .(CVE-2023-20900)

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/en/security/safety-bull…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2023-20867	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2023-20900	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "open-vm-tools-12.0.5-3.oe2203.aarch64.rpm",
          "open-vm-tools-debuginfo-12.0.5-3.oe2203.aarch64.rpm",
          "open-vm-tools-devel-12.0.5-3.oe2203.aarch64.rpm",
          "open-vm-tools-sdmp-12.0.5-3.oe2203.aarch64.rpm",
          "open-vm-tools-test-12.0.5-3.oe2203.aarch64.rpm",
          "open-vm-tools-debugsource-12.0.5-3.oe2203.aarch64.rpm",
          "open-vm-tools-desktop-12.0.5-3.oe2203.aarch64.rpm"
        ],
        "src": [
          "open-vm-tools-12.0.5-3.oe2203.src.rpm"
        ],
        "x86_64": [
          "open-vm-tools-debugsource-12.0.5-3.oe2203.x86_64.rpm",
          "open-vm-tools-desktop-12.0.5-3.oe2203.x86_64.rpm",
          "open-vm-tools-test-12.0.5-3.oe2203.x86_64.rpm",
          "open-vm-tools-salt-minion-12.0.5-3.oe2203.x86_64.rpm",
          "open-vm-tools-devel-12.0.5-3.oe2203.x86_64.rpm",
          "open-vm-tools-sdmp-12.0.5-3.oe2203.x86_64.rpm",
          "open-vm-tools-12.0.5-3.oe2203.x86_64.rpm",
          "open-vm-tools-debuginfo-12.0.5-3.oe2203.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS",
        "name": "open-vm-tools",
        "purl": "pkg:rpm/openEuler/open-vm-tools\u0026distro=openEuler-22.03-LTS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.0.5-3.oe2203"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "The  project is an open source implementation of VMware Tools. It is a suite of open source virtualization utilities and drivers to improve the functionality, user experience and administration of VMware virtual machines. This package contains only the core user-space programs and libraries of .\r\n\r\nSecurity Fix(es):\r\n\r\nA fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.(CVE-2023-20867)\r\n\r\nA malicious actor that has been granted  Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html \u00a0in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged  Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .(CVE-2023-20900)",
  "id": "OESA-2023-1629",
  "modified": "2026-08-06T11:06:04Z",
  "published": "2023-09-15T11:06:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1629"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20867"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20900"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "open-vm-tools security update",
  "upstream": [
    "CVE-2023-20867",
    "CVE-2023-20900"
  ]
}

OESA-2023-1630 (CVE-2023-20867)

Vulnerability from osv_openeuler – Published: 2023-09-15 11:06 – Updated: 2026-08-06 11:06 – Source website

CISA Previdian

Summary

open-vm-tools security update

Details

Security Fix(es):

A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.(CVE-2023-20867)

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/en/security/safety-bull…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2023-20867	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2023-20900	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "open-vm-tools-debugsource-12.0.5-3.oe2203sp1.aarch64.rpm",
          "open-vm-tools-sdmp-12.0.5-3.oe2203sp1.aarch64.rpm",
          "open-vm-tools-desktop-12.0.5-3.oe2203sp1.aarch64.rpm",
          "open-vm-tools-test-12.0.5-3.oe2203sp1.aarch64.rpm",
          "open-vm-tools-debuginfo-12.0.5-3.oe2203sp1.aarch64.rpm",
          "open-vm-tools-devel-12.0.5-3.oe2203sp1.aarch64.rpm",
          "open-vm-tools-12.0.5-3.oe2203sp1.aarch64.rpm"
        ],
        "src": [
          "open-vm-tools-12.0.5-3.oe2203sp1.src.rpm"
        ],
        "x86_64": [
          "open-vm-tools-debuginfo-12.0.5-3.oe2203sp1.x86_64.rpm",
          "open-vm-tools-test-12.0.5-3.oe2203sp1.x86_64.rpm",
          "open-vm-tools-debugsource-12.0.5-3.oe2203sp1.x86_64.rpm",
          "open-vm-tools-salt-minion-12.0.5-3.oe2203sp1.x86_64.rpm",
          "open-vm-tools-devel-12.0.5-3.oe2203sp1.x86_64.rpm",
          "open-vm-tools-sdmp-12.0.5-3.oe2203sp1.x86_64.rpm",
          "open-vm-tools-12.0.5-3.oe2203sp1.x86_64.rpm",
          "open-vm-tools-desktop-12.0.5-3.oe2203sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP1",
        "name": "open-vm-tools",
        "purl": "pkg:rpm/openEuler/open-vm-tools\u0026distro=openEuler-22.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.0.5-3.oe2203sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "The  project is an open source implementation of VMware Tools. It is a suite of open source virtualization utilities and drivers to improve the functionality, user experience and administration of VMware virtual machines. This package contains only the core user-space programs and libraries of .\r\n\r\nSecurity Fix(es):\r\n\r\nA fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.(CVE-2023-20867)\r\n\r\nA malicious actor that has been granted  Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html \u00a0in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged  Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .(CVE-2023-20900)",
  "id": "OESA-2023-1630",
  "modified": "2026-08-06T11:06:04Z",
  "published": "2023-09-15T11:06:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1630"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20867"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20900"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "open-vm-tools security update",
  "upstream": [
    "CVE-2023-20867",
    "CVE-2023-20900"
  ]
}

OESA-2023-1631 (CVE-2023-20867)

Vulnerability from osv_openeuler – Published: 2023-09-15 11:06 – Updated: 2026-08-06 11:06 – Source website

CISA Previdian

Summary

open-vm-tools security update

Details

Security Fix(es):

A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.(CVE-2023-20867)

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/en/security/safety-bull…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2023-20867	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2023-20900	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "open-vm-tools-test-12.1.5-2.oe2203sp2.aarch64.rpm",
          "open-vm-tools-devel-12.1.5-2.oe2203sp2.aarch64.rpm",
          "open-vm-tools-12.1.5-2.oe2203sp2.aarch64.rpm",
          "open-vm-tools-debugsource-12.1.5-2.oe2203sp2.aarch64.rpm",
          "open-vm-tools-desktop-12.1.5-2.oe2203sp2.aarch64.rpm",
          "open-vm-tools-debuginfo-12.1.5-2.oe2203sp2.aarch64.rpm",
          "open-vm-tools-sdmp-12.1.5-2.oe2203sp2.aarch64.rpm"
        ],
        "src": [
          "open-vm-tools-12.1.5-2.oe2203sp2.src.rpm"
        ],
        "x86_64": [
          "open-vm-tools-test-12.1.5-2.oe2203sp2.x86_64.rpm",
          "open-vm-tools-sdmp-12.1.5-2.oe2203sp2.x86_64.rpm",
          "open-vm-tools-devel-12.1.5-2.oe2203sp2.x86_64.rpm",
          "open-vm-tools-salt-minion-12.1.5-2.oe2203sp2.x86_64.rpm",
          "open-vm-tools-debuginfo-12.1.5-2.oe2203sp2.x86_64.rpm",
          "open-vm-tools-debugsource-12.1.5-2.oe2203sp2.x86_64.rpm",
          "open-vm-tools-12.1.5-2.oe2203sp2.x86_64.rpm",
          "open-vm-tools-desktop-12.1.5-2.oe2203sp2.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP2",
        "name": "open-vm-tools",
        "purl": "pkg:rpm/openEuler/open-vm-tools\u0026distro=openEuler-22.03-LTS-SP2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.1.5-2.oe2203sp2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "The  project is an open source implementation of VMware Tools. It is a suite of open source virtualization utilities and drivers to improve the functionality, user experience and administration of VMware virtual machines. This package contains only the core user-space programs and libraries of .\r\n\r\nSecurity Fix(es):\r\n\r\nA fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.(CVE-2023-20867)\r\n\r\nA malicious actor that has been granted  Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html \u00a0in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged  Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .(CVE-2023-20900)",
  "id": "OESA-2023-1631",
  "modified": "2026-08-06T11:06:04Z",
  "published": "2023-09-15T11:06:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1631"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20867"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20900"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "open-vm-tools security update",
  "upstream": [
    "CVE-2023-20867",
    "CVE-2023-20900"
  ]
}

OPENSUSE-SU-2024:13022-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00

Summary

libvmtools-devel-12.2.0-4.1 on GA media

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2023-20867.

CVE-2023-20867

3.9 (Low)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Recommended: 28 products

Open the full advisory

RHSA-2023:3944

Vulnerability from csaf_redhat - Published: 2023-06-29 15:15 - Updated: 2026-06-25 11:02

Summary

Red Hat Security Advisory: open-vm-tools security and bug fix update

Severity

Low

Scope

1 vulnerability in this advisory, including CVE-2023-20867.

CVE-2023-20867

A flaw was found in the open-vm-tools package. An attacker with root access privileges over ESXi may be able to cause an authentication bypass in the vgauth module. This may lead to compromised confidentiality and integrity.

3.9 (Low)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Fixed: 24 products

https://access.redhat.com/errata/RHSA-2023:3944

Open the full advisory

RHSA-2023:3945

Vulnerability from csaf_redhat - Published: 2023-06-29 15:05 - Updated: 2025-11-21 18:41

Summary

Red Hat Security Advisory: open-vm-tools security update

Severity

Low

Scope

1 vulnerability in this advisory, including CVE-2023-20867.

CVE-2023-20867

3.9 (Low)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Fixed: 21 products

https://access.redhat.com/errata/RHSA-2023:3945

Open the full advisory

RHSA-2023:3946

Vulnerability from csaf_redhat - Published: 2023-06-29 15:07 - Updated: 2025-11-21 18:41

Summary

Red Hat Security Advisory: open-vm-tools security update

Severity

Low

Scope

1 vulnerability in this advisory, including CVE-2023-20867.

CVE-2023-20867

3.9 (Low)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Fixed: 27 products

https://access.redhat.com/errata/RHSA-2023:3946

Open the full advisory

RHSA-2023:3947

Vulnerability from csaf_redhat - Published: 2023-06-29 15:05 - Updated: 2025-11-21 18:41

Summary

Red Hat Security Advisory: open-vm-tools security update

Severity

Low

Scope

1 vulnerability in this advisory, including CVE-2023-20867.

CVE-2023-20867

3.9 (Low)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Fixed: 18 products

https://access.redhat.com/errata/RHSA-2023:3947

Open the full advisory

RHSA-2023:3948

Vulnerability from csaf_redhat - Published: 2023-06-29 15:12 - Updated: 2025-11-21 18:41

Summary

Red Hat Security Advisory: open-vm-tools security update

Severity

Low

Scope

1 vulnerability in this advisory, including CVE-2023-20867.

CVE-2023-20867

3.9 (Low)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Fixed: 19 products

https://access.redhat.com/errata/RHSA-2023:3948

Open the full advisory

RHSA-2023:3949

Vulnerability from csaf_redhat - Published: 2023-06-29 15:18 - Updated: 2025-11-21 18:41

Summary

Red Hat Security Advisory: open-vm-tools security update

Severity

Low

Scope

1 vulnerability in this advisory, including CVE-2023-20867.

CVE-2023-20867

3.9 (Low)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Fixed: 10 products

https://access.redhat.com/errata/RHSA-2023:3949

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2023-20867 (GCVE-0-2023-20867)

CISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Vendor Report Successful Exploitation Confidence: 80% Source: cisa-kev

Details

References

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Successful Exploitation Confidence: 70% Source: kevintel

Details

References

OESA-2023-1629 (CVE-2023-20867)

OESA-2023-1630 (CVE-2023-20867)

OESA-2023-1631 (CVE-2023-20867)

OPENSUSE-SU-2024:13022-1

RHSA-2023:3944

RHSA-2023:3945

RHSA-2023:3946

RHSA-2023:3947

RHSA-2023:3948

RHSA-2023:3949

Tags

Sightings

Nomenclature

Related by attack behaviour