April 23, 2025
Proactive Defense: The Importance of Incident Response Planning in Cybersecurity
Rewterz Threat Advisory – CVE-2023-23695 – Dell Secure Connect Gateway Vulnerability
February 22, 2023Rewterz Threat Advisory – CVE-2023-20858 – VMware Carbon Black App Control (App Control) Vulnerability
February 22, 2023Rewterz Threat Advisory – CVE-2023-23695 – Dell Secure Connect Gateway Vulnerability
February 22, 2023Rewterz Threat Advisory – CVE-2023-20858 – VMware Carbon Black App Control (App Control) Vulnerability
February 22, 2023
Severity
High
Analysis Summary
CVE-2023-20855
VMware vRealize Orchestrator is vulnerable to an XML external entity injection (XXE) attack when processing XML data, caused by a weakly configured XML parser. By using specially-crafted XML content, a remote authenticated attacker could exploit this vulnerability to read arbitrary files, cause a denial of service, conduct an SSRF attack, or achieve other system impacts.
Impact
- Gain Access
Indicators Of Compromise
CVE
- CVE-2023-20855
Affected Vendors
VMware
Affected Products
- VMware Cloud Foundation 4.0
- VMware vRealize Orchestrator 8.11
- VMware vRealize Automation 8.11
Remediation
Refer to VMware Security Advisory for patch, upgrade or suggested workaround information.
