VMware addresses critical vulnerabilities in Aria Operations for Networks

VMware, the virtualization technology giant, released urgent fixes on Wednesday to address security flaws in its Aria Operations for Networks product. These vulnerabilities put enterprises at risk by exposing them to possible remote code execution attacks.

Three critical vulnerabilities in network and application monitoring

In an advisory, VMware has documented three critical vulnerabilities affecting its network and application monitoring tool. The company specifically highlighted a command injection issue (CVE-2023-20887) with a CVSSv3 base score of 9.8 out of 10. An attacker with network access could exploit this vulnerability in VMware Aria Operations for Networks to execute a command injection attack, leading to remote code execution.

Use of Aria Operations for Networks in companies

VMware's Aria Operations for Networks, formerly known as vRealize Network Insight, is used by enterprises to monitor, discover and analyze networks and applications in order to build a secure network infrastructure across various clouds.

Two more vulnerabilities documented by VMware

VMware has also documented an authenticated deserialization vulnerability (CVE-2023-20888) that allows a malicious actor with network access and valid "member" role credentials to launch a deserialization attack that leads to remote code execution. This bug has a CVSSv3 base score of 9.1 out of 10. The company also fixed an information disclosure flaw (CVE-2023-20889) that allows an attacker with access to the VMware Aria Operations for Networks network to execute command injection attacks leading to the disclosure of sensitive data.