VMware Vulnerability Tracker.
This page holds short security alerts about vulnerabilities in VMware products. It covers 2 items from January 2023 to February 2023. Each entry keeps its original title, publish date and text, newest first and grouped by quarter. Earlier addresses of these entries now lead to the matching entry here.
2023 Q1
Critical Vulnerability Alert In VMware Carbon Black App Control
Published:
VMware has released updates that address a critical security vulnerability affecting the Carbon Black App Control platform used for enterprise security. VMware Carbon Black App Control is a security product used to ensure that only trusted and approved software can run on critical systems and endpoints.
The Vulnerability in VMware Carbon Black App Control Platform Has a 9.1 CVSS Score
The security vulnerability, identified as CVE-2023-20858, is caused by improper validation of user-supplied input. A remote user with privileged access to the App Control management console can execute arbitrary code on the target system through a specially crafted request.
The security vulnerability affects App Control 8.7.x, 8.8.x, and 8.9.x versions running on the Windows operating system and has been resolved with the release of versions 8.9.4, 8.8.6, and 8.7.8. Users of these versions that have not been updated are advised to apply the updates promptly to prevent potential exploitation.
Critical RCE Alarm In VMware vRealize Log Insight
Published:
VMware has released updates for four security vulnerabilities that could have allowed remote code execution in the VMware vRealize Log Insight solution. vRealize Log Insight is a log management tool that helps to collect, view and analyze logs from monitoring or network solutions.
The critical vulnerabilities, identified as CVE-2022-31706 and CVE-2022-31704, are caused by directory traversal errors and improper access restrictions.
The company has released version 8.10.2 of VMware vRealize Log Insight, which addresses these vulnerabilities. There have been no findings of active exploitation of these vulnerabilities. It is recommended that these updates be applied as soon as possible to prevent potential attacks.
Know What Is Exposed. Before Attackers Do.
Book a demo of the platform.
- 4.7Gartner Peer Insights
- 24hEarly warning time
- 190+Countries covered
What you see in the demo
- Your exposureAssets and services seen from the outside, starting from your own domain.
- Threats aimed at youLeaked credentials, look-alike domains and brand abuse in one view.
- From alert to actionHow findings reach your team and what to do next.