Vulnerability record · CVE-2023-20889 · published 7 June 2023
CVE-2023-20889: VMware Aria Operations for Networks command injection information disclosure
Vmware · Vrealize Network Insight
VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection flaw (CWE-77) that lets a remote attacker disclose information. The vendor advisory is the only reference and it is tagged as a patch, so affected version ranges are not stated in this record. With a CVSS of 7.5 and no privileges or user interaction required, it is a serious network-reachable issue for exposed deployments.
Description
Aria Operations for Networks contains an information disclosure vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in information disclosure.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Automated analysis
high priorityNetwork-reachable, unauthenticated command injection with high confidentiality impact and very high EPSS, though no confirmed in-the-wild exploitation is recorded.
What it is
VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection flaw (CWE-77) that lets a remote attacker disclose information. The vendor advisory is the only reference and it is tagged as a patch, so affected version ranges are not stated in this record. With a CVSS of 7.5 and no privileges or user interaction required, it is a serious network-reachable issue for exposed deployments.
Impact
An attacker gains access to information held by the appliance, with high confidentiality impact and no integrity or availability impact per the CVSS vector. The exact data exposed is not specified in the record.
Attack surface
Reachable over the network (AV:N) with no authentication (PR:N) and no user interaction (UI:N), so any host that can reach the Aria Operations for Networks interface can attempt it. The description says network access to the product is the only precondition.
Exploitation
Not listed in CISA KEV and no public exploit or exploitation tag appears in the references, but EPSS is very high (0.79258, 99.58th percentile), indicating elevated predicted exploitation activity. Treat as likely to be targeted.
What to do
- Apply the patch from VMware advisory VMSA-2023-0012, which is the only reference provided.
- Restrict network access to Aria Operations for Networks management interfaces to trusted hosts or admin networks.
- Place the appliance behind a firewall or VPN and remove any direct internet exposure.
- Monitor vendor advisories for updated affected-version details, since this record does not list them.
Detection
- Review appliance and web logs for unexpected command or shell metacharacters in requests to Aria Operations for Networks endpoints.
- Alert on outbound connections or data transfers from the appliance to unfamiliar destinations.
- Monitor for unusual child processes spawned by the appliance's web or application services.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://www.vmware.com/security/advisories/VMSA-2023-0012.html | PatchVendor Advisory |
| https://www.vmware.com/security/advisories/VMSA-2023-0012.html | PatchVendor Advisory |
Track CVE-2023-20889 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-20889), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
