CVE-2023-20878: 
VMware vRealize Operations Manager vulnerability analysis and mitigation

VMware Aria Operations (formerly vRealize Operations) contains a deserialization vulnerability identified as CVE-2023-20878. The vulnerability was discovered and privately reported to VMware by Y4er of 埃文科技, with the initial CVE allocation date being November 1, 2022. The vulnerability affects VMware Aria Operations versions 8.6.x and 8.10.x, as well as VMware Cloud Foundation 4.x (VMware Advisory).

The vulnerability is classified as a deserialization vulnerability with a CVSS v3.1 base score of 7.2 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The weakness is categorized under CWE-502 (Deserialization of Untrusted Data) (NVD).

When exploited, this vulnerability allows a malicious actor with administrative privileges to execute arbitrary commands and disrupt the system (VMware Advisory).

The vulnerability requires administrative privileges to exploit, indicating a somewhat limited attack surface. The attack vector is network-accessible with low attack complexity, though it requires high privileges and no user interaction (NVD).

VMware has released patches to address this vulnerability. For version 8.10.x, users should upgrade to 8.10 Hot Fix 4, and for version 8.6.x, users should upgrade to 8.6 Hot Fix 10. VMware Cloud Foundation users should refer to KB92148 for remediation instructions. No workarounds are available for this vulnerability (VMware Advisory).