VMware vRealize Operations vulnerabilities

18 CVEs affecting VMware vRealize Operations, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-20879, published 2023-05-12.

More from VMware.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2016-7457, published 2016-12-29. Critical severity, CVSS 10.0. EPSS: 3.2% chance of exploitation in the next 30 days. VMware vRealize Operations (aka vROps) 6.x before 6.4.0 allows remote authenticated users to gain privileges, or halt and remove virtual machines, via unspecified vectors.
• CVE-2020-3943, published 2020-02-19. Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days. vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) uses a JMX RMI service which is not securely configured. An unauthenticated remote attacker who has network…
• CVE-2016-7462, published 2016-12-29. High severity, CVSS 8.5. EPSS: 2% chance of exploitation in the next 30 days. The Suite REST API in VMware vRealize Operations (aka vROps) 6.x before 6.4.0 allows remote authenticated users to write arbitrary content to files or rename files via a crafted DiskFileItem in a…
• CVE-2022-31673, published 2022-08-10. High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days. VMware vRealize Operations contains an information disclosure vulnerability. A low-privileged malicious actor with network access can create and leak hex dumps, leading to information disclosure.…
• CVE-2020-3944, published 2020-02-19. High severity, CVSS 8.6. EPSS: 1.5% chance of exploitation in the next 30 days. vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) has an improper trust store configuration leading to authentication bypass. An unauthenticated remote attacker…
• CVE-2020-3945, published 2020-02-19. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) contains an information disclosure vulnerability due to incorrect pairing implementation between the vRealize…
• CVE-2022-31707, published 2022-12-16. High severity, CVSS 7.2. EPSS: 1% chance of exploitation in the next 30 days. vRealize Operations (vROps) contains a privilege escalation vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of…
• CVE-2023-20878, published 2023-05-12. High severity, CVSS 7.2. EPSS: 1% chance of exploitation in the next 30 days. VMware Aria Operations contains a deserialization vulnerability. A malicious actor with administrative privileges can execute arbitrary commands and disrupt the system.
• CVE-2022-31708, published 2022-12-16. Medium severity, CVSS 4.9. EPSS: 0.8% chance of exploitation in the next 30 days. vRealize Operations (vROps) contains a broken access control vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of…
• CVE-2022-31675, published 2022-08-10. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. VMware vRealize Operations contains an authentication bypass vulnerability. An unauthenticated malicious actor with network access may be able to create a user with administrative privileges.

Latest

• CVE-2023-20879, published 2023-05-12. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. VMware Aria Operations contains a Local privilege escalation vulnerability. A malicious actor with administrative privileges in the Aria Operations application can gain root access to the underlying…
• CVE-2023-20877, published 2023-05-12. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. VMware Aria Operations contains a privilege escalation vulnerability. An authenticated malicious user with ReadOnly privileges can perform code execution leading to privilege escalation.
• CVE-2023-20856, published 2023-02-01. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. VMware vRealize Operations (vROps) contains a CSRF bypass vulnerability. A malicious user could execute actions on the vROps platform on behalf of the authenticated victim user.
• CVE-2022-31682, published 2022-10-11. Medium severity, CVSS 4.9. EPSS: 0.7% chance of exploitation in the next 30 days. VMware Aria Operations contains an arbitrary file read vulnerability. A malicious actor with administrative privileges may be able to read arbitrary files containing sensitive data.
• CVE-2022-31674, published 2022-08-10. Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days. VMware vRealize Operations contains an information disclosure vulnerability. A low-privileged malicious actor with network access can access log files that lead to information disclosure.