CVE-2023-20855

VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability

High · published February 21, 2023

CVSS v3.1
8.8
EPSS
1%
Percentile
69.5
In the wild
Unconfirmed
What it is

VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. A malicious actor, with non-administrative access to vRealize Orchestrator, may be able to use specially crafted input to bypass XML parsing restrictions leading to access to sensitive information or possible escalation of privileges.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01265 · 69.5th percentile
Published
2023-02-21T00:00Z
EPSS history
Timeline
  • 21 FEB 00:00Z
    VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability
    cvelistv5