CVE-2023-20900 json
A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A95…
published 2023-08-31 3 y ago modified 2026-10-08 31 d ago also EUVD-2023-25069
- cvss
- 7.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.5%
- EPSS 1.5% chance of exploitation in 30 days, percentile 74%
- public exploits
- 0
- none known
Summary
A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .
Patch / fix
- vmware tools 10.3.26, 12.3.0
- vmware open_vm_tools 12.3.0
- open-vm-tools Debian 12 2:12.2.0-1+deb12u1
- open-vm-tools Debian 14, Debian 13 2:12.3.0-1
debian advisories DEBIAN-CVE-2023-20900
- open-vm-tools Ubuntu 20.04 LTS 2:11.3.0-2ubuntu0~ubuntu20.04.6
- open-vm-tools Ubuntu 22.04 LTS 2:12.1.5-3~ubuntu0.22.04.3
- open-vm-tools Ubuntu Pro 16.04 LTS 2:10.2.0-3~ubuntu0.16.04.1+esm3
- open-vm-tools Ubuntu Pro 18.04 LTS 2:11.0.5-4ubuntu0.18.04.3+esm2
ubuntu advisories UBUNTU-CVE-2023-20900
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- open-vm-tools RHEL 8 12.1.5-2.el8_8.3
- open-vm-tools-sdmp RHEL 8 12.1.5-2.el8_8.3
- open-vm-tools-desktop RHEL 8 12.1.5-2.el8_8.3
- open-vm-tools-salt-minion RHEL 8 12.1.5-2.el8_8.3
- open-vm-tools RHEL 9 12.1.5-1.el9_2.3
- open-vm-tools-sdmp RHEL 9 12.1.5-1.el9_2.3
- open-vm-tools-test RHEL 9 12.1.5-1.el9_2.3
- open-vm-tools-desktop RHEL 9 12.1.5-1.el9_2.3
red hat advisories RHSA-2024:5315RHSA-2023:5312RHSA-2023:5313RHSA-2023:5213RHSA-2023:5210RHSA-2023:5217
- open-vm-tools SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Module for Desktop Applications 15 SP5 +14 more 12.3.0-150300.37.1
- open-vm-tools SLES for SAP 12 SP5, SLES 12 SP5 12.3.0-4.59.1
- open-vm-tools SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Module for Desktop Applications 15 SP5 +14 more 12.2.0-150300.33.1
- open-vm-tools SLES for SAP 12 SP5, SLES 12 SP5 12.2.0-4.56.2
- open-vm-tools SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLE High Performance Computing 15 SP2-LTSS +1 more 11.3.5-150200.5.16.16.1
- open-vm-tools SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLE High Performance Computing 15 SP1-LTSS 11.3.5-150100.4.37.18.1
suse advisories SUSE-SU-2023:3835-1SUSE-SU-2023:3795-1SUSE-SU-2023:3507-1SUSE-SU-2023:3506-1SUSE-SU-2023:3505-1SUSE-SU-2023:3504-1
- open-vm-tools openSUSE Tumbleweed 12.2.0-6.1
opensuse advisories openSUSE-SU-2024:13186-1
- open-vm-tools AlmaLinux 8 12.1.5-2.el8_8.3.alma.1
- open-vm-tools-sdmp AlmaLinux 8 12.1.5-2.el8_8.3.alma.1
- open-vm-tools-desktop AlmaLinux 8 12.1.5-2.el8_8.3.alma.1
- open-vm-tools-salt-minion AlmaLinux 8 12.1.5-2.el8_8.3.alma.1
- open-vm-tools AlmaLinux 9 12.1.5-1.el9_2.3.alma.1
- open-vm-tools-sdmp AlmaLinux 9 12.1.5-1.el9_2.3.alma.1
- open-vm-tools-test AlmaLinux 9 12.1.5-1.el9_2.3.alma.1
- open-vm-tools-desktop AlmaLinux 9 12.1.5-1.el9_2.3.alma.1
almalinux advisories ALSA-2023:5312ALSA-2023:5313
- open-vm-tools Rocky Linux 9 12.1.5-1.el9_2.3
- open-vm-tools Rocky Linux 8 12.1.5-2.el8_8.3
rocky linux advisories RLSA-2023:5313RLSA-2023:5312
- open-vm-tools Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 12.3.0-r0
alpine advisories ALPINE-CVE-2023-20900
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2023-20900 updated cvss 7.1
open-vm-tools: SAML token signature bypass
-
Red Hat Enterprise Linux AppStream (v. 8) open-vm-tools 12.1.5-2.el8_8.3, open-vm-tools-sdmp 12.1.5-2.el8_8.3, open-vm-tools-desktop 12.1.5-2.el8_8.3, open-vm-tools-salt-minion 12.1.5-2.el8_8.3fixed: vendor fix RHSA-2023:5312
-
Red Hat Enterprise Linux AppStream (v. 9) open-vm-tools 12.1.5-1.el9_2.3, open-vm-tools-sdmp 12.1.5-1.el9_2.3, open-vm-tools-test 12.1.5-1.el9_2.3, open-vm-tools-desktop 12.1.5-1.el9_2.3, open-vm-tools-salt-minion 12.1.5-1.el9_2.3fixed: vendor fix RHSA-2023:5313
-
Red Hat Enterprise Linux AppStream AUS (v. 8.2) open-vm-tools 11.0.0-4.el8_2.3, open-vm-tools-desktop 11.0.0-4.el8_2.3fixed: vendor fix RHSA-2023:5210
-
Red Hat Enterprise Linux AppStream AUS (v.8.4) open-vm-tools 11.2.0-2.el8_4.3, open-vm-tools-sdmp 11.2.0-2.el8_4.3, open-vm-tools-desktop 11.2.0-2.el8_4.3fixed: vendor fix RHSA-2023:5216
-
Red Hat Enterprise Linux AppStream E4S (v. 8.1) open-vm-tools 10.3.10-3.el8_1.4, open-vm-tools-desktop 10.3.10-3.el8_1.4fixed: vendor fix RHSA-2023:5213
-
Red Hat Enterprise Linux AppStream E4S (v. 8.2) open-vm-tools 11.0.0-4.el8_2.3, open-vm-tools-desktop 11.0.0-4.el8_2.3fixed: vendor fix RHSA-2023:5210
-
Red Hat Enterprise Linux AppStream E4S (v.8.4) open-vm-tools 11.2.0-2.el8_4.3, open-vm-tools-sdmp 11.2.0-2.el8_4.3, open-vm-tools-desktop 11.2.0-2.el8_4.3fixed: vendor fix RHSA-2023:5216
-
Red Hat Enterprise Linux AppStream EUS (v.8.6) open-vm-tools 11.3.5-1.el8_6.4, open-vm-tools-sdmp 11.3.5-1.el8_6.4, open-vm-tools-desktop 11.3.5-1.el8_6.4fixed: vendor fix RHSA-2023:5220
show 8 moreshow fewer
-
Red Hat Enterprise Linux AppStream EUS (v.9.0) open-vm-tools 11.3.5-1.el9_0.4, open-vm-tools-sdmp 11.3.5-1.el9_0.4, open-vm-tools-test 11.3.5-1.el9_0.4, open-vm-tools-desktop 11.3.5-1.el9_0.4fixed: vendor fix RHSA-2023:5218
-
Red Hat Enterprise Linux AppStream TUS (v. 8.2) open-vm-tools 11.0.0-4.el8_2.3, open-vm-tools-desktop 11.0.0-4.el8_2.3fixed: vendor fix RHSA-2023:5210
-
Red Hat Enterprise Linux AppStream TUS (v.8.4) open-vm-tools 11.2.0-2.el8_4.3, open-vm-tools-sdmp 11.2.0-2.el8_4.3, open-vm-tools-desktop 11.2.0-2.el8_4.3fixed: vendor fix RHSA-2023:5216
-
Red Hat Enterprise Linux Client (v. 7) open-vm-tools 11.0.5-3.el7_9.7, open-vm-tools-desktop 11.0.5-3.el7_9.7 Red Hat Enterprise Linux Client Optional (v. 7) open-vm-tools-test 11.0.5-3.el7_9.7 Red Hat Enterprise Linux ComputeNode Optional (v. 7) open-vm-tools-test 11.0.5-3.el7_9.7 Red Hat Enterprise Linux Server (v. 7) open-vm-tools 11.0.5-3.el7_9.7, open-vm-tools-desktop 11.0.5-3.el7_9.7fixed: vendor fix RHSA-2023:5217
-
Red Hat Enterprise Linux Server AUS (v. 7.7) open-vm-tools 10.3.0-2.el7_7.3, open-vm-tools-desktop 10.3.0-2.el7_7.3fixed: vendor fix RHSA-2024:5315
-
Red Hat Enterprise Linux Server Optional (v. 7) open-vm-tools-test 11.0.5-3.el7_9.7fixed: vendor fix RHSA-2023:5217
-
Red Hat Enterprise Linux Server Optional AUS (v. 7.7) open-vm-tools-test 10.3.0-2.el7_7.3fixed: vendor fix RHSA-2024:5315
-
Red Hat Enterprise Linux Workstation (v. 7) open-vm-tools 11.0.5-3.el7_9.7, open-vm-tools-desktop 11.0.5-3.el7_9.7 Red Hat Enterprise Linux Workstation Optional (v. 7) open-vm-tools-test 11.0.5-3.el7_9.7fixed: vendor fix RHSA-2023:5217
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 31 d ago
Exploit prediction
1.47% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- n/a VMware Tools
- n/a VMware Tools (open-vm-tools)
Classification
- Weakness
-
- CWE-294 Authentication Bypass by Capture-replay
- Technology feeds
References
-
vmware.com
/security/advisories/VMSA-2023-0019.html
patch, vendor-advisory
-
openwall.com
/lists/oss-security/2023/10/27/1
mailing-list, patch
-
openwall.com
/lists/oss-security/2023/08/31/1
mailing-list, third-party-advisory
-
debian.org
/security/2023/dsa-5493
third-party-advisory
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/ZJM6HDRQYS74JA7YNKQBFH2XSZ52HEWH/
mailing-list
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/NVKQ6Y2JFJRWPFOZUOTFO3H27BK5GGOG/
mailing-list
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/TJNJMD67QIT6LXLKWSHFM47DCLRSMT6W/
mailing-list
-
lists.debian.org
/debian-lts-announce/2023/10/msg00000.html
mailing-list
-
security.netapp.com
/advisory/ntap-20231013-0002/
third-party-advisory
Sources
- CVE List CVE-2023-20900
- NVD CVE-2023-20900
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.