Headline

CVE-2023-20854: VMSA-2023-0003

VMware Workstation contains an arbitrary file deletion vulnerability. A malicious actor with local user privileges on the victim’s machine may exploit this vulnerability to delete arbitrary files from the file system of the machine on which Workstation is installed.

1 year ago

CVE

Open in Source

#vulnerability #mac #windows #vmware

Advisory ID: VMSA-2023-0003

CVSSv3 Range: 7.8

Issue Date: 2023-02-02

Updated On: 2023-02-02 (Initial Advisory)

CVE(s): CVE-2023-20854

Synopsis: VMware Workstation update addresses an arbitrary file deletion vulnerability (CVE-2023-20854)

****1. Impacted Products****

VMware Workstation

****2. Introduction****

An arbitrary file deletion vulnerability in VMware Workstation was privately reported to VMware. Updates are available to remediate this vulnerability in the affected VMware product.

****3. Arbitrary file deletion vulnerability (CVE-2023-20854)****

VMware Workstation contains an arbitrary file deletion vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.8.

A malicious actor with local user privileges on the victim’s machine may exploit this vulnerability to delete arbitrary files from the file system of the machine on which Workstation is installed.

To remediate CVE-2023-20854 update to the version listed in the ‘Fixed Version’ column of the ‘Response Matrix’ found below.

VMware would like to thank Frederik Reiter of cirosec GmbH for reporting this issue to us.

Product

Version

Running On

CVE Identifier

CVSSv3

Severity

Fixed Version

Workarounds

Additional Documentation

VMware Workstation