Urgent: VMware Warns of Unpatched Critical Cloud Director Vulnerability

VMware is warning of a critical and unpatched security flaw in Cloud Director that could be exploited by a destructive actor to get about authentication protections.

Tracked as CVE-2023-34060 (CVSS score: 9.8), the vulnerability impacts scenarios that have been upgraded to edition 10.5 from an older model.

“On an upgraded variation of VMware Cloud Director Appliance 10.5, a destructive actor with network access to the appliance can bypass login limits when authenticating on port 22 (ssh) or port 5480 (equipment administration console),” the corporation claimed in an alert.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

“This bypass is not existing on port 443 (VCD service provider and tenant login). On a new installation of VMware Cloud Director Equipment 10.5, the bypass is not existing.”

The virtualization providers company further pointed out that the influence is because of to the point that it utilizes a variation of sssd from the fundamental Photon OS that is impacted by CVE-2023-34060.

Dustin Hartle from IT answers provider Best Integrations has been credited with discovering and reporting the shortcomings.

Although VMware has yet to launch a fix for the challenge, it has offered a workaround in the type of a shell script (“WA_CVE-2023-34060.sh”).

It also emphasized utilizing the short term mitigation will neither require downtime nor have a aspect-effect on the features of Cloud Director installations.

The improvement will come months after VMware released patches for another critical flaw in the vCenter Server (CVE-2023-34048, CVSS rating: 9.8) that could consequence in distant code execution on afflicted programs.

Located this posting exciting? Abide by us on Twitter  and LinkedIn to examine much more unique content material we article.