VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injection vulnerability. A malicious actor with privileged access to the App Control administration console may be able to use specially crafted input allowing access to the underlying server operating system.
References
| Link | Resource |
|---|---|
| https://www.vmware.com/security/advisories/VMSA-2023-0004.html | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
03 Mar 2023, 14:01
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Vmware carbon Black App Control
Microsoft windows Microsoft Vmware |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.2 |
| CPE | cpe:2.3:a:vmware:carbon_black_app_control:*:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* |
|
| CWE | CWE-74 | |
| References | (MISC) https://www.vmware.com/security/advisories/VMSA-2023-0004.html - Patch, Vendor Advisory |
22 Feb 2023, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-02-22 00:15
Updated : 2023-12-10 14:48
NVD link : CVE-2023-20858
Mitre link : CVE-2023-20858
CVE.ORG link : CVE-2023-20858
JSON object : View
Products Affected
microsoft
- windows
vmware
- carbon_black_app_control
CWE
CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')