CVE-2023-20858

—

CVSS 3.1

7.2 high

EPSS

17%p97

Published

Feb 22, 2023 (Feb 22, 2023)

Modified

Jun 17, 2026

Description

VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injection vulnerability. A malicious actor with privileged access to the App Control administration console may be able to use specially crafted input allowing access to the underlying server operating system.

Vendors: vmware
Products: carbon black app control
Weakness: CWE-74
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (16.9%)

In the news4 stories

Week in review: ChatGPT and cybersecurity, hidden vulnerabilities in Docker containers

Help Net SecurityFeb 26, 00:00 UTC · Feb 26, 2023Vulnerability CVE-2023-20858 CVE-2022-39952

VMware addressed a critical bug in Carbon Black App Control

Security AffairsFeb 22, 08:45 UTC · Feb 22, 2023Vulnerability CVE-2023-20858

VMware Patches Critical Vulnerability in Carbon Black App Control Product

The Hacker NewsFeb 22, 07:59 UTC · Feb 22, 2023Vulnerability CVE-2023-20858 CVE-2022-22951 CVE-2022-22952+1 CVEs

VMware patches critical injection flaw in Carbon Black App Control (CVE-2023-20858)

Help Net SecurityFeb 22, 00:00 UTC · Feb 22, 2023Vulnerability in the wildCVE-2023-20858 CVE-2023-20855