CVE-2023-20900 | Date: (C)2023-08-31 (M)2024-01-19 |
A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html ��in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .
CVSS Score and Metrics +CVSS Score and Metrics -CVSS V3 Severity: | CVSS V2 Severity: |
CVSS Score : 7.5 | CVSS Score : |
Exploit Score: 1.6 | Exploit Score: |
Impact Score: 5.9 | Impact Score: |
|
CVSS V3 Metrics: | CVSS V2 Metrics: |
Attack Vector: ADJACENT_NETWORK | Access Vector: |
Attack Complexity: HIGH | Access Complexity: |
Privileges Required: NONE | Authentication: |
User Interaction: NONE | Confidentiality: |
Scope: UNCHANGED | Integrity: |
Confidentiality: HIGH | Availability: |
Integrity: HIGH | |
Availability: HIGH | |
| |