Severity
High
Analysis Summary
CVE-2023-20855
VMware vRealize Orchestrator is vulnerable to an XML external entity injection (XXE) attack when processing XML data, caused by a weakly configured XML parser. By using specially-crafted XML content, a remote authenticated attacker could exploit this vulnerability to read arbitrary files, cause a denial of service, conduct an SSRF attack, or achieve other system impacts.
Impact
- Gain Access
Indicators Of Compromise
CVE
- CVE-2023-20855
Affected Vendors
VMware
Affected Products
- VMware Cloud Foundation 4.0
- VMware vRealize Orchestrator 8.11
- VMware vRealize Automation 8.11
Remediation
Refer to VMware Security Advisory for patch, upgrade or suggested workaround information.