VMware Warns of Unpatched Critical Cloud Director Vulnerability

Nov 15, 2023NewsroomNetwork Securit / Vulnerability

Cloud Director Vulnerability

VMware is warning of a critical and unpatched security flaw in Cloud Director that could be exploited by a malicious actor to bypass authentication protections.

Tracked as CVE-2023-34060 (CVSS score: 9.8), the vulnerability affects instances that have been upgraded to version 10.5 from an older version.

“In an upgraded version of VMware Cloud Director Appliance 10.5, a malicious actor with network access to the appliance could bypass login restrictions when authenticating on port 22 (ssh) or port 5480 (appliance management console),” the company SAYS in an alert.

“This bypass does not exist on port 443 (VCD provider and tenant login). In a new installation of VMware Cloud Director Appliance 10.5, the bypass does not exist.”

The virtualization service company further noted that the impact is due to the fact that it uses a version of the sssd from the underlying Photon OS that is affected by CVE-2023-34060.

Cybersecurity

Dustin Hartle from IT solutions provider Ideal Integrations is credited with discovering and reporting the flaws.

While VMware has not yet released a fix for the problem, it has provided a SOLUTIONS in the form of a shell script (“WA_CVE-2023-34060.sh”).

It also emphasizes that the implementation of temporary mitigation will not require downtime or have a side-effect on the operation of Cloud Director installations.

The development comes weeks after VMware released patches for another critical flaw in vCenter Server (CVE-2023-34048, CVSS score: 9.8) that could result in remote code execution on affected systems.

Did you find this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

Leave a comment