www.vmware.com
Open in
urlscan Pro
2a02:26f0:dc:396::2ef
Public Scan
URL:
https://www.vmware.com/security/advisories/VMSA-2023-0003.html
Submission: On February 03 via api from IN — Scanned from DE
Submission: On February 03 via api from IN — Scanned from DE
Form analysis
3 forms found in the DOM//www.vmware.com/search.html
<form action="//www.vmware.com/search.html" id="globalsearch" class="wrapperSearch">
<input type="text" name="q" id="ub-search" class="d-none" placeholder="Search" aria-role="searchbox" role="searchbox">
<a href="javascript:void(0);" aria-label="Search vmware.com" class="search-icon ml-lg-3" name="nav_utility : Search">
<i class="fa fa-search text-indigo mr-2 mr-lg-0" aria-hidden="true"></i>
</a>
<input type="hidden" name="num" value="20">
<input type="hidden" name="filter" value="0">
<input type="hidden" name="ie" value="UTF-8">
<input type="hidden" name="oe" value="UTF-8">
<input type="hidden" name="entqr" value="0">
<input type="hidden" name="start" value="0">
<input type="hidden" name="sort" value="">
<input type="hidden" name="tlen" value="200">
<input type="hidden" name="numgm" value="3">
<input type="hidden" name="cn" value="vmware">
<input type="hidden" name="cid" value="">
<input type="hidden" name="tid" value="">
<input type="hidden" name="getfields" value="*">
<input type="hidden" name="partialfields" value="">
<input type="hidden" name="requiredfields" value="">
<input type="hidden" name="place" value="top">
<input type="hidden" name="client" value="VMware_Site_1">
<input type="hidden" name="site" value="VMware_Site_1">
<input type="hidden" name="cc" value="en">
<input type="hidden" name="stype" value="main">
</form>
//www.vmware.com/search.html
<form action="//www.vmware.com/search.html" id="globalsearch" class="wrapperSearch">
<a href="javascript:void(0);" tabindex="-1" class="search-icon ml-lg-3" name="nav_utility : Search">
</a>
<input type="text" name="q" id="ub-search" placeholder="Search" role="searchbox">
<input type="hidden" name="num" value="20">
<input type="hidden" name="filter" value="0">
<input type="hidden" name="ie" value="UTF-8">
<input type="hidden" name="oe" value="UTF-8">
<input type="hidden" name="entqr" value="0">
<input type="hidden" name="start" value="0">
<input type="hidden" name="sort" value="">
<input type="hidden" name="tlen" value="200">
<input type="hidden" name="numgm" value="3">
<input type="hidden" name="cn" value="vmware">
<input type="hidden" name="cid" value="">
<input type="hidden" name="tid" value="">
<input type="hidden" name="getfields" value="*">
<input type="hidden" name="partialfields" value="">
<input type="hidden" name="requiredfields" value="">
<input type="hidden" name="place" value="top">
<input type="hidden" name="client" value="VMware_Site_1">
<input type="hidden" name="site" value="VMware_Site_1">
<input type="hidden" name="cc" value="en">
<input type="hidden" name="stype" value="main">
</form>
Name: securitysignup —
<form accept-charset="UNKNOWN" id="securitysignup" name="securitysignup" data-gtm-form-interact-id="0">
<label class="email-input-label" for="securityEmail">*Email</label>
<input id="securityEmail" name="email" size="25" type="text" data-gtm-form-interact-field-id="0">
<span class="subscriptionerrorMsg sa-validation-alerts" tabindex="0"></span>
<input name="email-button" class="sa-subscription-modal-button sa-subscription-submit-button" type="submit" onclick="s_objectID='content_advisories : : 0';" value="Submit">
</form>
Text Content
Skip to Promo Skip to main content Global Search US Store Login Cloud Services Console Customer Connect Partner Connect * Multi-Cloud Environments * Products * Solutions * Partners * Resources GET STARTED Global Search Main Menu TAKE CONTROL OF YOUR MULTI-CLOUD ENVIRONMENT 73% OF ENTERPRISES USE TWO OR MORE PUBLIC CLOUDS TODAY. WHILE MULTI-CLOUD ACCELERATES DIGITAL TRANSFORMATION, IT ALSO INTRODUCES COMPLEXITY AND RISK. VMWARE CROSS-CLOUD™ SERVICES ENABLE ORGANIZATIONS TO UNLOCK THE POTENTIAL OF MULTI-CLOUD WITH ENTERPRISE SECURITY AND RESILIENCY. BUILD & OPERATE CLOUD NATIVE APPS GIVE DEVELOPERS THE FLEXIBILITY TO USE ANY APP FRAMEWORK AND TOOLING FOR A SECURE, CONSISTENT AND FAST PATH TO PRODUCTION ON ANY CLOUD. CONNECT & SECURE APPS & CLOUDS DELIVER SECURITY AND NETWORKING AS A BUILT-IN DISTRIBUTED SERVICE ACROSS USERS, APPS, DEVICES, AND WORKLOADS IN ANY CLOUD. RUN ENTERPRISE APPS ANYWHERE RUN ENTERPRISE APPS AND PLATFORM SERVICES AT SCALE ACROSS PUBLIC AND TELCO CLOUDS, DATA CENTERS AND EDGE ENVIRONMENTS. AUTOMATE & OPTIMIZE APPS & CLOUDS OPERATE APPS AND INFRASTRUCTURE CONSISTENTLY, WITH UNIFIED GOVERNANCE AND VISIBILITY INTO PERFORMANCE AND COSTS ACROSS CLOUDS. ACCESS ANY APP ON ANY DEVICE EMPOWER YOUR EMPLOYEES TO BE PRODUCTIVE FROM ANYWHERE, WITH SECURE, FRICTIONLESS ACCESS TO ENTERPRISE APPS FROM ANY DEVICE. SEE HOW VMWARE CAN HELP LEARN ABOUT CROSS-CLOUD SERVICES Main Menu ANYWHERE WORKSPACE Access Any App on Any Device Securely Horizon Horizon Cloud Workspace ONE Workspace ONE UEM APP PLATFORM Build and Operate Cloud Native Apps Tanzu CLOUD & EDGE INFRASTRUCTURE Run Enterprise Apps Anywhere SD-WAN/SASE Telco Cloud vCenter vSAN/vSAN+ vSphere/vSphere+ VMware Cloud Disaster Recovery CLOUD MANAGEMENT Automate and Optimize Apps and Clouds VMware Aria CloudHealth Skyline DESKTOP HYPERVISOR Manage apps in a local virtualization sandbox Fusion for Mac Workstation Player Workstation Pro SECURITY & NETWORKING Connect and Secure Apps and Clouds Carbon Black Cloud Carbon Black Endpoint NSX NSX Advanced Load Balancer NSX Distributed Firewall RUN VMWARE ON ANY CLOUD. ANY ENVIRONMENT. ANYWHERE. ON PUBLIC & HYBRID CLOUDS Alibaba Cloud VMware Service Azure VMware Solution Google Cloud VMware Engine IBM Cloud for VMware Solutions Oracle Cloud VMware Solutions VMware Cloud Foundation VMware Cloud on AWS VMware Cloud on AWS GovCloud (US) ON PRIVATE CLOUD & HCI Dell EMC VxRail VMware on AWS Outposts VMware Verified Cloud Providers SEE ALL PRODUCTS SaaS (Subscription) product version available Main Menu SOLUTIONS ANYWHERE WORKSPACE ACCESS ANY APP ON ANY DEVICE SECURELY APP PLATFORM BUILD AND OPERATE CLOUD NATIVE APPS CLOUD INFRASTRUCTURE RUN ENTERPRISE APPS ANYWHERE CLOUD MANAGEMENT AUTOMATE AND OPTIMIZE APPS AND CLOUDS EDGE INFRASTRUCTURE ENABLE THE MULTI-CLOUD EDGE NETWORKING ENABLE CONNECTIVITY FOR APPS AND CLOUDS SECURITY SECURE APPS AND CLOUDS BY INDUSTRY Communications Service Providers Federal Government Financial Services Healthcare Providers State and Local Government MANAGE YOUR MULTI-CLOUD ENVIRONMENT Multi-cloud made easy with a family of multi-cloud services designed to build, run, manage and secure any app on any cloud. LEARN MORE SEE ALL SOLUTIONS SEE ALL INDUSTRIES Main Menu FOR CUSTOMERS Find a Cloud Provider Find a Partner VMware Marketplace Work with a Partner FOR PARTNERS Become a Cloud Provider Cloud Partner Navigator Get Cloud Verified Learning and Selling Resources Partner Connect Login Partner Executive Edge Technology Partner Hub Work with VMware WORKING TOGETHER WITH PARTNERS FOR CUSTOMER SUCCESS See how we work with a global partner to help companies prepare for multi-cloud. VIEW PARTNER STORY Main Menu TOOLS & TRAINING VMware Customer Connect VMware Trust Center Learning & Certification Tech Zone Product Downloads Product Trials Cloud Services Engagement Platform Hands-on Labs SERVICES Professional Services Customer Success SUPPORT VMware Customer Connect Support Offerings Skyline Support Customer Welcome Center MARKETPLACE Cloud Marketplace VMware Marketplace BLOGS & COMMUNITIES Blogs Podcasts News & Stories Communities CUSTOMERS Customer Stories EVENTS VMware Explore SpringOne All Events & Webcasts SEE ALL RESOURCES Important Advisory ID: VMSA-2023-0003 CVSSv3 Range: 7.8 Issue Date: 2023-02-02 Updated On: 2023-02-02 (Initial Advisory) CVE(s): CVE-2023-20854 Synopsis: VMware Workstation update addresses an arbitrary file deletion vulnerability (CVE-2023-20854) RSS Feed Download PDF Download Text File Share this page on social media: Sign up for Security Advisories SIGN UP FOR SECURITY ADVISORIES Stay up to date on the latest VMware Security advisories and updates. Close *Email 1. IMPACTED PRODUCTS * VMware Workstation 2. INTRODUCTION An arbitrary file deletion vulnerability in VMware Workstation was privately reported to VMware. Updates are available to remediate this vulnerability in the affected VMware product. 3. ARBITRARY FILE DELETION VULNERABILITY (CVE-2023-20854) Description VMware Workstation contains an arbitrary file deletion vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.8. Known Attack Vectors A malicious actor with local user privileges on the victim's machine may exploit this vulnerability to delete arbitrary files from the file system of the machine on which Workstation is installed. Resolution To remediate CVE-2023-20854 update to the version listed in the 'Fixed Version' column of the 'Response Matrix' found below. Workarounds None. Additional Documentation None. Notes None. Acknowledgements VMware would like to thank Frederik Reiter of cirosec GmbH for reporting this issue to us. Response Matrix Product Version Running On CVE Identifier CVSSv3 Severity Fixed Version Workarounds Additional Documentation VMware Workstation 17.x Windows CVE-2023-20854 7.8 important 17.0.1 None None 4. REFERENCES Fixed Version(s) and Release Notes: VMware Workstation 17.0.1: Downloads and Documentation: https://customerconnect.vmware.com/en/downloads/info/slug/desktop_end_user_computing/vmware_workstation_pro/17_0 https://docs.vmware.com/en/VMware-Workstation-Pro/17.0.1/rn/vmware-workstation-1701-pro-release-notes/index.html Mitre CVE Dictionary Links: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20854 FIRST CVSSv3 Calculator: CVE-2023-20854: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 5. CHANGE LOG 2023-02-02 VMSA-2023-0003 Initial security advisory. 6. CONTACT E-mail list for product security notifications and announcements: https://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce This Security Advisory is posted to the following lists: security-announce@lists.vmware.com bugtraq@securityfocus.com fulldisclosure@seclists.org E-mail: security@vmware.com PGP key at: https://kb.vmware.com/kb/1055 VMware Security Advisories https://www.vmware.com/security/advisories VMware Security Response Policy https://www.vmware.com/support/policies/security_response.html VMware Lifecycle Support Phases https://www.vmware.com/support/policies/lifecycle.html VMware Security & Compliance Blog https://blogs.vmware.com/security Twitter https://twitter.com/VMwareSRC Copyright 2023 VMware Inc. All rights reserved. Company About Us Executive Leadership News & Stories Investor Relations Customer Stories Diversity, Equity & Inclusion Environment, Social & Governance Careers Blogs Communities Acquisitions Office Locations VMware Cloud Trust Center COVID-19 Resources Support VMware Customer Connect Support Policies Product Documentation Compatibility Guide Terms & Conditions California Transparency Act Statement Twitter YouTube Facebook LinkedIn Contact Sales -------------------------------------------------------------------------------- © 2023 VMware, Inc. Terms of Use Your California Privacy Rights Privacy Accessibility Site Map Trademarks Glossary Help Feedback Cookie Settings We use cookies to provide you with the best experience on our website, to improve usability and performance and thereby improve what we offer to you. Our website may also use third-party cookies to display advertising that is more relevant to you. By clicking on the “Accept All” button you agree to the storing of cookies on your device. If you want to know more about how we use cookies, please see our Cookie Policy. Cookie Settings Accept All Cookies COOKIE PREFERENCE CENTER GENERAL INFORMATION ON COOKIES GENERAL INFORMATION ON COOKIES When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our Cookie Policy. * STRICTLY NECESSARY STRICTLY NECESSARY Always Active Strictly Necessary Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org. Cookie Details * PERFORMANCE PERFORMANCE Performance Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate. Cookie Details * FUNCTIONAL FUNCTIONAL Functional Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly. Cookie Details * ADVERTISING ADVERTISING Advertising Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device. Cookie Details * SOCIAL MEDIA SOCIAL MEDIA Social Media Social media cookies are intended to facilitate the sharing of content and to improve the user experience. These cookies can sometimes track your activities. We do not control social media cookies and they do not allow us to gain access to your social media accounts. Please refer to the relevant social media platform’s privacy policies for more information. Cookie Details Back Button ADVERTISING COOKIES Filter Button Consent Leg.Interest Select All Vendors Select All Vendors Select All Hosts Select All * REPLACE-WITH-DYANMIC-HOST-ID View Third Party Cookies * Name cookie name Clear Filters Information storage and access Apply Confirm My Choices Allow All word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word mmMwWLliI0fiflO&1 mmMwWLliI0fiflO&1 mmMwWLliI0fiflO&1 mmMwWLliI0fiflO&1 mmMwWLliI0fiflO&1 mmMwWLliI0fiflO&1 mmMwWLliI0fiflO&1