CVE-2023-20865

—

CVSS 3.1

7.2 high

EPSS

2%p75

Published

Apr 20, 2023 (Apr 20, 2023)

Modified

Jun 17, 2026

Description

VMware Aria Operations for Logs contains a command injection vulnerability. A malicious actor with administrative privileges in VMware Aria Operations for Logs can execute arbitrary commands as root.

Vendors: vmware
Products: aria operations for logs, cloud foundation
Weakness: CWE-77
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.6%)

In the news6 stories

VMware plugs security holes in VMware Aria Operations for Logs (CVE-2023-20864, CVE-2023-20865)

Help Net SecurityJul 11, 10:40 UTC · Jul 11, 2023Vulnerability in the wildCVE-2023-20864 CVE-2023-20865

VMware warns customers of exploit available for critical vRealize RCE flaw CVE-2023

Security AffairsJul 11, 08:20 UTC · Jul 11, 2023Vulnerability in the wildCVE-2023-20864 CVE-2023-20865 CVE-2023-20887

VMware fixes CVE-2023-20887 bug in Aria Operations for Networks

Security AffairsJun 7, 21:02 UTC · Jun 7, 2023Vulnerability CVE-2023-20887 CVE-2023-20888 CVE-2023-20889+2 CVEs

Week in review: PaperCut vulnerabilities, VMware fixes critical flaws, RSA Conference 2023

Help Net SecurityApr 30, 00:00 UTC · Apr 30, 2023Vulnerability CVE-2023-27524 CVE-2023-20869 CVE-2023-20870+4 CVEs

Cisco and VMware Release Security Updates to Patch Critical Flaws in their Products

The Hacker NewsApr 21, 05:41 UTC · Apr 21, 2023Vulnerability CVE-2023-20036 CVE-2023-20039 CVE-2023-20154+4 CVEs

A critical flaw in VMware vRealize allows executing code as root

Security AffairsApr 20, 22:20 UTC · Apr 20, 2023Vulnerability CVE-2023-20864 CVE-2023-20865