CVE-2023-20867 kev in the critical feed json
VMware Tools Authentication Bypass Vulnerability
published 2023-06-13 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-25040
- cvss
- 3.9
- version 3.1, CNA
- cisa kev
- Exploited
- added 2023-06-23
- epss
- 13.6%
- EPSS 13.6% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known
Summary
A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.
Patch / fix
cisa required action Apply updates per vendor instructions.
- vmware tools 12.2.5
- open-vm-tools Debian 12 2:12.2.0-1+deb12u1
- open-vm-tools Debian 14, Debian 13 2:12.2.5-1
debian advisories DEBIAN-CVE-2023-20867
- open-vm-tools Ubuntu 20.04 LTS 2:11.3.0-2ubuntu0~ubuntu20.04.5
- open-vm-tools Ubuntu 22.04 LTS 2:12.1.5-3~ubuntu0.22.04.2
- open-vm-tools Ubuntu Pro 16.04 LTS 2:10.2.0-3~ubuntu0.16.04.1+esm2
- open-vm-tools Ubuntu Pro 18.04 LTS 2:11.0.5-4ubuntu0.18.04.3+esm1
ubuntu advisories UBUNTU-CVE-2023-20867
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- open-vm-tools RHEL 9 12.1.5-1.el9_2.1
- open-vm-tools-sdmp RHEL 9 12.1.5-1.el9_2.1
- open-vm-tools-test RHEL 9 12.1.5-1.el9_2.1
- open-vm-tools-desktop RHEL 9 12.1.5-1.el9_2.1
- open-vm-tools-salt-minion RHEL 9 12.1.5-1.el9_2.1
- open-vm-tools RHEL 8 12.1.5-2.el8_8
- open-vm-tools-sdmp RHEL 8 12.1.5-2.el8_8
- open-vm-tools-desktop RHEL 8 12.1.5-2.el8_8
red hat advisories RHSA-2023:3947RHSA-2023:3950RHSA-2023:3948RHSA-2023:3946RHSA-2023:3949RHSA-2023:3945
- open-vm-tools SLE Real Time 15 SP3, SLE Module for Desktop Applications 15 SP5, SLE Module for Desktop Applications 15 SP4 +16 more 12.2.0-150300.29.1
- open-vm-tools SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLE High Performance Computing 15 SP2-LTSS +1 more 11.3.5-150200.5.16.16.1
- open-vm-tools SLES for SAP 12 SP5, SLES 12 SP5 12.2.0-4.53.1
- open-vm-tools SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLE High Performance Computing 15 SP1-LTSS 11.3.5-150100.4.37.18.1
suse advisories SUSE-SU-2023:2604-2SUSE-SU-2023:3505-1SUSE-SU-2023:3504-1SUSE-SU-2023:2604-1SUSE-SU-2023:2530-1
- open-vm-tools openSUSE Tumbleweed 12.2.0-4.1
opensuse advisories openSUSE-SU-2024:13022-1
- open-vm-tools AlmaLinux 9 12.1.5-1.el9_2.1.alma
- open-vm-tools-sdmp AlmaLinux 9 12.1.5-1.el9_2.1.alma
- open-vm-tools-test AlmaLinux 9 12.1.5-1.el9_2.1.alma
- open-vm-tools-desktop AlmaLinux 9 12.1.5-1.el9_2.1.alma
- open-vm-tools-salt-minion AlmaLinux 9 12.1.5-1.el9_2.1.alma
- open-vm-tools AlmaLinux 8 12.1.5-2.el8_8.alma
- open-vm-tools-sdmp AlmaLinux 8 12.1.5-2.el8_8.alma
- open-vm-tools-desktop AlmaLinux 8 12.1.5-2.el8_8.alma
almalinux advisories ALSA-2023:3948ALSA-2023:3949
- open-vm-tools Rocky Linux 9 12.1.5-1.el9_2.1
- open-vm-tools Rocky Linux 8 12.1.5-2.el8_8
rocky linux advisories RLSA-2023:3948RLSA-2023:3949
- open-vm-tools Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 12.2.5-r0
alpine advisories ALPINE-CVE-2023-20867
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2023-20867 updated cvss 3.9
open-vm-tools: authentication bypass vulnerability in the vgauth module
-
Red Hat Enterprise Linux AppStream (v. 8) open-vm-tools 12.1.5-2.el8_8, open-vm-tools-sdmp 12.1.5-2.el8_8, open-vm-tools-desktop 12.1.5-2.el8_8, open-vm-tools-salt-minion 12.1.5-2.el8_8fixed: vendor fix RHSA-2023:3949
-
Red Hat Enterprise Linux AppStream (v. 9) open-vm-tools 12.1.5-1.el9_2.1, open-vm-tools-sdmp 12.1.5-1.el9_2.1, open-vm-tools-test 12.1.5-1.el9_2.1, open-vm-tools-desktop 12.1.5-1.el9_2.1, open-vm-tools-salt-minion 12.1.5-1.el9_2.1fixed: vendor fix RHSA-2023:3948
-
Red Hat Enterprise Linux AppStream AUS (v. 8.2) open-vm-tools 11.0.0-4.el8_2.2, open-vm-tools-desktop 11.0.0-4.el8_2.2fixed: vendor fix RHSA-2023:3945
-
Red Hat Enterprise Linux AppStream AUS (v.8.4) open-vm-tools 11.2.0-2.el8_4.2, open-vm-tools-sdmp 11.2.0-2.el8_4.2, open-vm-tools-desktop 11.2.0-2.el8_4.2fixed: vendor fix RHSA-2023:3946
-
Red Hat Enterprise Linux AppStream E4S (v. 8.2) open-vm-tools 11.0.0-4.el8_2.2, open-vm-tools-desktop 11.0.0-4.el8_2.2fixed: vendor fix RHSA-2023:3945
-
Red Hat Enterprise Linux AppStream E4S (v.8.4) open-vm-tools 11.2.0-2.el8_4.2, open-vm-tools-sdmp 11.2.0-2.el8_4.2, open-vm-tools-desktop 11.2.0-2.el8_4.2fixed: vendor fix RHSA-2023:3946
-
Red Hat Enterprise Linux AppStream EUS (v.8.6) open-vm-tools 11.3.5-1.el8_6.2, open-vm-tools-sdmp 11.3.5-1.el8_6.2, open-vm-tools-desktop 11.3.5-1.el8_6.2fixed: vendor fix RHSA-2023:3950
-
Red Hat Enterprise Linux AppStream EUS (v.9.0) open-vm-tools 11.3.5-1.el9_0.2, open-vm-tools-sdmp 11.3.5-1.el9_0.2, open-vm-tools-test 11.3.5-1.el9_0.2, open-vm-tools-desktop 11.3.5-1.el9_0.2fixed: vendor fix RHSA-2023:3947
show 3 moreshow fewer
-
Red Hat Enterprise Linux AppStream TUS (v. 8.2) open-vm-tools 11.0.0-4.el8_2.2, open-vm-tools-desktop 11.0.0-4.el8_2.2fixed: vendor fix RHSA-2023:3945
-
Red Hat Enterprise Linux AppStream TUS (v.8.4) open-vm-tools 11.2.0-2.el8_4.2, open-vm-tools-sdmp 11.2.0-2.el8_4.2, open-vm-tools-desktop 11.2.0-2.el8_4.2fixed: vendor fix RHSA-2023:3946
-
Red Hat Enterprise Linux Client (v. 7) open-vm-tools 11.0.5-3.el7_9.6, open-vm-tools-test 11.0.5-3.el7_9.6, open-vm-tools-desktop 11.0.5-3.el7_9.6 Red Hat Enterprise Linux Client Optional (v. 7) open-vm-tools 11.0.5-3.el7_9.6, open-vm-tools-test 11.0.5-3.el7_9.6, open-vm-tools-desktop 11.0.5-3.el7_9.6 Red Hat Enterprise Linux ComputeNode Optional (v. 7) open-vm-tools 11.0.5-3.el7_9.6, open-vm-tools-test 11.0.5-3.el7_9.6, open-vm-tools-desktop 11.0.5-3.el7_9.6 Red Hat Enterprise Linux Server (v. 7) open-vm-tools 11.0.5-3.el7_9.6, open-vm-tools-test 11.0.5-3.el7_9.6, open-vm-tools-desktop 11.0.5-3.el7_9.6 Red Hat Enterprise Linux Server Optional (v. 7) open-vm-tools 11.0.5-3.el7_9.6, open-vm-tools-test 11.0.5-3.el7_9.6, open-vm-tools-desktop 11.0.5-3.el7_9.6 Red Hat Enterprise Linux Workstation (v. 7) open-vm-tools 11.0.5-3.el7_9.6, open-vm-tools-test 11.0.5-3.el7_9.6, open-vm-tools-desktop 11.0.5-3.el7_9.6fixed: vendor fix RHSA-2023:3944
+1 more productsfewer
Red Hat Enterprise Linux Workstation Optional (v. 7) open-vm-tools 11.0.5-3.el7_9.6, open-vm-tools-test 11.0.5-3.el7_9.6, open-vm-tools-desktop 11.0.5-3.el7_9.6
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Timeline
- Published
- Added to CISA KEV
- CISA patch deadline
- CISA SSVC: exploitation active
Known exploited
- Added
- 3 y ago
- Patch by
- 2023-07-14 (3 y ago)
- Ransomware
- Not known
- Required action
- Apply updates per vendor instructions.
- Vendor, product
- VMware, Tools
- CISA name
- VMware Tools Authentication Bypass Vulnerability
ATT&CK techniques
How it is exploited and what it leads to, in MITRE ATT&CK terms.
- T1078 Valid Accounts exploitation
- T1059 Command and Scripting Interpreter primary impact
- T1105 Ingress Tool Transfer secondary impact
kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- no
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
13.64% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.9 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N |
| NVD | 3.1 | 3.9 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N |
Affected products
- VMware VMware Tools
Classification
- Weakness
-
- CWE-287 Improper Authentication
- Technology feeds
References
-
vmware.com
/security/advisories/VMSA-2023-0013.html
patch, vendor-advisory
-
openwall.com
/lists/oss-security/2023/10/16/2
mailing-list, patch
-
openwall.com
/lists/oss-security/2023/10/16/11
mailing-list, patch
-
security.netapp.com
/advisory/ntap-20230725-0001/
third-party-advisory
-
lists.debian.org
/debian-lts-announce/2023/08/msg00020.html
mailing-list, third-party-advisory
-
debian.org
/security/2023/dsa-5493
mailing-list, third-party-advisory
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/ZJM6HDRQYS74JA7YNKQBFH2XSZ52HEWH/
mailing-list, release-notes
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/NVKQ6Y2JFJRWPFOZUOTFO3H27BK5GGOG/
mailing-list, release-notes
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/TJNJMD67QIT6LXLKWSHFM47DCLRSMT6W/
mailing-list, release-notes
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20867
government-resource, us-government-resource
Sources
- CVE List CVE-2023-20867
- NVD CVE-2023-20867
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.