Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2023-0015
CVE-2023-0015:
SAP BusinessObjects Business Intelligence Platform vulnerability analysis and mitigation
Overview
VMware SD-WAN contains a bypass authentication vulnerability identified as CVE-2023-20899, which was privately reported to VMware. The vulnerability affects VMware SD-WAN Edge devices and was disclosed on July 6, 2023. The vulnerability has been evaluated to be in the moderate severity range with a CVSSv3 base score of 5.3 (VMware Advisory).
Technical details
The vulnerability allows a malicious actor with network access to the Edge Local Web UI to download an Edge Diagnostic bundle of the application without authentication. It's important to note that Local Web UI Access is disabled by default. The vulnerability has been assigned a moderate severity rating with a CVSSv3 base score of 5.3 (VMware Advisory).
Impact
If exploited, this vulnerability allows unauthorized access to Edge Diagnostic bundles through the Edge Local Web UI. The impact is limited as the Local Web UI is disabled by default, which serves as a natural mitigation factor (VMware Advisory).
Mitigation and workarounds
VMware has released version 4.5.2 to address this vulnerability. Additionally, VMware recommends leaving the Local Web UI disabled, which is the default configuration. For cases where Local Web UI has been manually enabled, instructions for disabling it can be found in the VMware SD-WAN Product Documentation. Following the Hardening Guidelines will prevent this vulnerability from being exploited (VMware Advisory).
Community reactions
VMware acknowledged Marco Bruinenberg of Accenture for reporting this security issue (VMware Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management