CVE-2023-20900: tools from 10.3.0 (inclusive), before 12.3.0 (exclusive), from 10.3.0 (inclusive), before 10.3.26 (exclusive); +6 more…

Affected technology

tools · from 10.3.0 (inclusive), before 12.3.0 (exclusive)
vmware

tools · from 10.3.0 (inclusive), before 10.3.26 (exclusive)
vmware

open vm tools · from 10.3.0 (inclusive), before 12.3.0 (exclusive)
vmware

fedora · 37
fedoraproject

fedora · 38
fedoraproject

fedora · 39
fedoraproject

debian linux · 10.0
debian

debian linux · 11.0
debian

debian linux · 12.0
debian

ontap select deploy administration utility · Version not applicable in the source CPE
netapp

VMware Tools · 12.x.x, 11.x.x, 10.3.x
Vendor not specified by the source

VMware Tools · 10.3.x
Vendor not specified by the source

VMware Tools (open-vm-tools) · 12.x.x, 11.x.x, 10.3.x
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Adjacent network · Low privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Adjacent network · No privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.1 assessment (base score 7.1/10) rates confidentiality, integrity and availability impact as high. NVD’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.