Urgent: VMware Warns of Unpatched Critical Cloud Director Vulnerability

VMware is warning of a critical and unpatched security flaw in Cloud Director that could be exploited by a malicious actor to get all over authentication protections.

Tracked as CVE-2023-34060 (CVSS rating: 9.8), the vulnerability impacts situations that have been upgraded to model 10.5 from an older model.

“On an upgraded variation of VMware Cloud Director Equipment 10.5, a destructive actor with network accessibility to the equipment can bypass login restrictions when authenticating on port 22 (ssh) or port 5480 (appliance management console),” the firm claimed in an alert.

“This bypass is not present on port 443 (VCD supplier and tenant login). On a new set up of VMware Cloud Director Equipment 10.5, the bypass is not existing.”

The virtualization solutions enterprise more famous that the impact is due to the truth that it utilizes a version of sssd from the underlying Photon OS that is impacted by CVE-2023-34060.

Dustin Hartle from IT answers supplier Best Integrations has been credited with finding and reporting the shortcomings.

Even though VMware has yet to release a resolve for the problem, it has presented a workaround in the sort of a shell script (“WA_CVE-2023-34060.sh”).

It also emphasised implementing the temporary mitigation will neither have to have downtime nor have a facet-influence on the features of Cloud Director installations.

The growth comes weeks soon after VMware unveiled patches for another critical flaw in the vCenter Server (CVE-2023-34048, CVSS rating: 9.8) that could final result in distant code execution on afflicted techniques.

Identified this article exciting? Comply with us on Twitter  and LinkedIn to browse a lot more distinctive content material we article.

Some parts of this article are sourced from:
thehackernews.com