Description
Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| VCF operations | VMware / VCF operations | >= 9.0.x, < 9.0.1.0 | affected |
| VMware Aria Operations | VMware / VMware Aria Operations | >= 8.18.x, < 8.18.5 | affected |
| VMware Cloud Foundation | VMware / VMware Cloud Foundation | >= 4.x, < 8.18.5 | affected |
| VMware Cloud Foundation | VMware / VMware Cloud Foundation | >= 5.x, < 8.18.5 | affected |
| VMware Telco Cloud Infrastructure | VMware / VMware Telco Cloud Infrastructure | >= 2.x, < 8.18.5 | affected |
| VMware Telco Cloud Infrastructure | VMware / VMware Telco Cloud Infrastructure | >= 3.x, < 8.18.5 | affected |
| VMware Telco Cloud Platform | VMware / VMware Telco Cloud Platform | >= 4.x, < 8.18.5 | affected |
| VMware Telco Cloud Platform | VMware / VMware Telco Cloud Platform | >= 5.x, < 8.18.5 | affected |
| VMware tools | VMware / VMware tools | >= 12.5.x, < 12.5.4 | affected |
| VMware tools | VMware / VMware tools | >= 13.x.x.x, < 13.0.5.0 | affected |