Vulnerabilites related to vmware - carbon_black_app_control
cve-2023-20858
Vulnerability from cvelistv5
Published
2023-02-21 00:00
Modified
2024-08-02 09:14
Severity ?
Summary
VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injection vulnerability. A malicious actor with privileged access to the App Control administration console may be able to use specially crafted input allowing access to the underlying server operating system.
References
https://www.vmware.com/security/advisories/VMSA-2023-0004.html
Impacted products
Vendor Product Version
n/a VMware Carbon Black App Control Version: VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T09:14:40.980Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.vmware.com/security/advisories/VMSA-2023-0004.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "VMware Carbon Black App Control",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injection vulnerability. A malicious actor with privileged access to the App Control administration console may be able to use specially crafted input allowing access to the underlying server operating system."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Injection vulnerability",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-02-21T00:00:00",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://www.vmware.com/security/advisories/VMSA-2023-0004.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2023-20858",
    "datePublished": "2023-02-21T00:00:00",
    "dateReserved": "2022-11-01T00:00:00",
    "dateUpdated": "2024-08-02T09:14:40.980Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2021-21998
Vulnerability from cvelistv5
Published
2021-06-23 11:10
Modified
2024-08-03 18:30
Severity ?
Summary
VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2 has an authentication bypass. A malicious actor with network access to the VMware Carbon Black App Control management server might be able to obtain administrative access to the product without the need to authenticate.
References
https://www.vmware.com/security/advisories/VMSA-2021-0012.html?x_refsource_MISC
Impacted products
Vendor Product Version
n/a VMware Carbon Black App Control (AppC) Version: VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:30:23.665Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.vmware.com/security/advisories/VMSA-2021-0012.html?"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "VMware Carbon Black App Control (AppC)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2 has an authentication bypass. A malicious actor with network access to the VMware Carbon Black App Control management server might be able to obtain administrative access to the product without the need to authenticate."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Authentication bypass?",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-23T11:10:25",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.vmware.com/security/advisories/VMSA-2021-0012.html?"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@vmware.com",
          "ID": "CVE-2021-21998",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "VMware Carbon Black App Control (AppC)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2 has an authentication bypass. A malicious actor with network access to the VMware Carbon Black App Control management server might be able to obtain administrative access to the product without the need to authenticate."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Authentication bypass?"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.vmware.com/security/advisories/VMSA-2021-0012.html?",
              "refsource": "MISC",
              "url": "https://www.vmware.com/security/advisories/VMSA-2021-0012.html?"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2021-21998",
    "datePublished": "2021-06-23T11:10:25",
    "dateReserved": "2021-01-04T00:00:00",
    "dateUpdated": "2024-08-03T18:30:23.665Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2022-22951
Vulnerability from cvelistv5
Published
2022-03-23 19:46
Modified
2024-08-03 03:28
Severity ?
Summary
VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains an OS command injection vulnerability. An authenticated, high privileged malicious actor with network access to the VMware App Control administration interface may be able to execute commands on the server due to improper input validation leading to remote code execution.
References
https://www.vmware.com/security/advisories/VMSA-2022-0008.htmlx_refsource_MISC
Impacted products
Vendor Product Version
n/a VMware Carbon Black App Control (AppC) Version: VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2)
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T03:28:42.678Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.vmware.com/security/advisories/VMSA-2022-0008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "VMware Carbon Black App Control (AppC)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains an OS command injection vulnerability. An authenticated, high privileged malicious actor with network access to the VMware App Control administration interface may be able to execute commands on the server due to improper input validation leading to remote code execution."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "OS command injection vulnerability in VMware Carbon Black App Control",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-23T19:46:46",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.vmware.com/security/advisories/VMSA-2022-0008.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@vmware.com",
          "ID": "CVE-2022-22951",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "VMware Carbon Black App Control (AppC)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains an OS command injection vulnerability. An authenticated, high privileged malicious actor with network access to the VMware App Control administration interface may be able to execute commands on the server due to improper input validation leading to remote code execution."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "OS command injection vulnerability in VMware Carbon Black App Control"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.vmware.com/security/advisories/VMSA-2022-0008.html",
              "refsource": "MISC",
              "url": "https://www.vmware.com/security/advisories/VMSA-2022-0008.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2022-22951",
    "datePublished": "2022-03-23T19:46:46",
    "dateReserved": "2022-01-10T00:00:00",
    "dateUpdated": "2024-08-03T03:28:42.678Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2022-22952
Vulnerability from cvelistv5
Published
2022-03-23 19:46
Modified
2024-08-03 03:28
Severity ?
Summary
VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains a file upload vulnerability. A malicious actor with administrative access to the VMware App Control administration interface may be able to execute code on the Windows instance where AppC Server is installed by uploading a specially crafted file.
References
https://www.vmware.com/security/advisories/VMSA-2022-0008.htmlx_refsource_MISC
Impacted products
Vendor Product Version
n/a VMware Carbon Black App Control (AppC) Version: VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2)
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T03:28:42.445Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.vmware.com/security/advisories/VMSA-2022-0008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "VMware Carbon Black App Control (AppC)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains a file upload vulnerability. A malicious actor with administrative access to the VMware App Control administration interface may be able to execute code on the Windows instance where AppC Server is installed by uploading a specially crafted file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "HFile upload vulnerability in VMware Carbon Black App Control",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-23T19:46:47",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.vmware.com/security/advisories/VMSA-2022-0008.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@vmware.com",
          "ID": "CVE-2022-22952",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "VMware Carbon Black App Control (AppC)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains a file upload vulnerability. A malicious actor with administrative access to the VMware App Control administration interface may be able to execute code on the Windows instance where AppC Server is installed by uploading a specially crafted file."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "HFile upload vulnerability in VMware Carbon Black App Control"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.vmware.com/security/advisories/VMSA-2022-0008.html",
              "refsource": "MISC",
              "url": "https://www.vmware.com/security/advisories/VMSA-2022-0008.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2022-22952",
    "datePublished": "2022-03-23T19:46:47",
    "dateReserved": "2022-01-10T00:00:00",
    "dateUpdated": "2024-08-03T03:28:42.445Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Vulnerability from fkie_nvd
Published
2022-03-23 20:15
Modified
2024-11-21 06:47
Severity ?
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Summary
VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains a file upload vulnerability. A malicious actor with administrative access to the VMware App Control administration interface may be able to execute code on the Windows instance where AppC Server is installed by uploading a specially crafted file.
References
security@vmware.comhttps://www.vmware.com/security/advisories/VMSA-2022-0008.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.vmware.com/security/advisories/VMSA-2022-0008.htmlPatch, Vendor Advisory
Impacted products
Vendor Product Version
vmware carbon_black_app_control *
vmware carbon_black_app_control *
vmware carbon_black_app_control *
vmware carbon_black_app_control *
microsoft windows -


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:carbon_black_app_control:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EB34F6FC-F097-4DA9-8722-A39F3F4BCF88",
              "versionEndExcluding": "8.5.14",
              "versionStartIncluding": "8.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:carbon_black_app_control:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5886E794-A457-472A-A25C-BC1186015A37",
              "versionEndExcluding": "8.6.6",
              "versionStartIncluding": "8.6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:carbon_black_app_control:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "81AB4436-EEE5-48AE-848B-6B0F611AFF92",
              "versionEndExcluding": "8.7.4",
              "versionStartIncluding": "8.7.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:carbon_black_app_control:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A9138626-BF09-4A39-A34D-D528F5A76A1F",
              "versionEndExcluding": "8.8.2",
              "versionStartIncluding": "8.8.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains a file upload vulnerability. A malicious actor with administrative access to the VMware App Control administration interface may be able to execute code on the Windows instance where AppC Server is installed by uploading a specially crafted file."
    },
    {
      "lang": "es",
      "value": "VMware Carbon Black App Control (versiones 8.5.x anteriores a 8.5.14, versiones 8.6.x anteriores a 8.6.6, versiones 8.7.x anteriores a 8.7.4 y versiones 8.8.x anteriores a 8.8.2) contiene una vulnerabilidad de carga de archivos. Un actor malicioso con acceso administrativo a la interfaz de administraci\u00f3n de VMware App Control puede ser capaz de ejecutar c\u00f3digo en la instancia de Windows donde est\u00e1 instalado AppC Server al cargar un archivo especialmente dise\u00f1ado"
    }
  ],
  "id": "CVE-2022-22952",
  "lastModified": "2024-11-21T06:47:40.390",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-03-23T20:15:10.840",
  "references": [
    {
      "source": "security@vmware.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.vmware.com/security/advisories/VMSA-2022-0008.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.vmware.com/security/advisories/VMSA-2022-0008.html"
    }
  ],
  "sourceIdentifier": "security@vmware.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2023-02-22 00:15
Modified
2024-11-21 07:41
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injection vulnerability. A malicious actor with privileged access to the App Control administration console may be able to use specially crafted input allowing access to the underlying server operating system.
References
security@vmware.comhttps://www.vmware.com/security/advisories/VMSA-2023-0004.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.vmware.com/security/advisories/VMSA-2023-0004.htmlPatch, Vendor Advisory
Impacted products
Vendor Product Version
vmware carbon_black_app_control *
vmware carbon_black_app_control *
vmware carbon_black_app_control *
microsoft windows -


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:carbon_black_app_control:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4C5A2498-F94D-44D0-B1F8-D8B4355B7DD4",
              "versionEndExcluding": "8.7.8",
              "versionStartIncluding": "8.7.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:carbon_black_app_control:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AB5BDDE2-A11A-4A9A-BF90-3019D32055A5",
              "versionEndExcluding": "8.8.6",
              "versionStartIncluding": "8.8.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:carbon_black_app_control:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4A752F50-23BD-4E47-9657-21F15080D210",
              "versionEndExcluding": "8.9.4",
              "versionStartIncluding": "8.9.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injection vulnerability. A malicious actor with privileged access to the App Control administration console may be able to use specially crafted input allowing access to the underlying server operating system."
    },
    {
      "lang": "es",
      "value": "VMware Carbon Black App Control 8.7.x anterior a 8.7.8, 8.8.x anterior a 8.8.6 y 8.9.x.anterior a 8.9.4 contienen una vulnerabilidad de inyecci\u00f3n. Un actor malintencionado con acceso privilegiado a la consola de administraci\u00f3n de App Control puede utilizar entradas especialmente manipuladas que permitan el acceso al sistema operativo del servidor subyacente."
    }
  ],
  "id": "CVE-2023-20858",
  "lastModified": "2024-11-21T07:41:42.477",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-02-22T00:15:11.570",
  "references": [
    {
      "source": "security@vmware.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.vmware.com/security/advisories/VMSA-2023-0004.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.vmware.com/security/advisories/VMSA-2023-0004.html"
    }
  ],
  "sourceIdentifier": "security@vmware.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2022-03-23 20:15
Modified
2024-11-21 06:47
Severity ?
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Summary
VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains an OS command injection vulnerability. An authenticated, high privileged malicious actor with network access to the VMware App Control administration interface may be able to execute commands on the server due to improper input validation leading to remote code execution.
References
security@vmware.comhttps://www.vmware.com/security/advisories/VMSA-2022-0008.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.vmware.com/security/advisories/VMSA-2022-0008.htmlPatch, Vendor Advisory
Impacted products
Vendor Product Version
vmware carbon_black_app_control *
vmware carbon_black_app_control *
vmware carbon_black_app_control *
vmware carbon_black_app_control *
microsoft windows -


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:carbon_black_app_control:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EB34F6FC-F097-4DA9-8722-A39F3F4BCF88",
              "versionEndExcluding": "8.5.14",
              "versionStartIncluding": "8.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:carbon_black_app_control:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5886E794-A457-472A-A25C-BC1186015A37",
              "versionEndExcluding": "8.6.6",
              "versionStartIncluding": "8.6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:carbon_black_app_control:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "81AB4436-EEE5-48AE-848B-6B0F611AFF92",
              "versionEndExcluding": "8.7.4",
              "versionStartIncluding": "8.7.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:carbon_black_app_control:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A9138626-BF09-4A39-A34D-D528F5A76A1F",
              "versionEndExcluding": "8.8.2",
              "versionStartIncluding": "8.8.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains an OS command injection vulnerability. An authenticated, high privileged malicious actor with network access to the VMware App Control administration interface may be able to execute commands on the server due to improper input validation leading to remote code execution."
    },
    {
      "lang": "es",
      "value": "VMware Carbon Black App Control (versiones 8.5.x anteriores a 8.5.14, versiones 8.6.x anteriores a 8.6.6, versiones 8.7.x anteriores a 8.7.4 y versiones 8.8.x anteriores a 8.8.2) contiene una vulnerabilidad de inyecci\u00f3n de comandos del Sistema Operativo. Un actor malicioso autenticado y con altos privilegios con acceso a la red a la interfaz de administraci\u00f3n de VMware App Control puede ser capaz de ejecutar comandos en el servidor debido a una incorrecta comprobaci\u00f3n de entrada conllevando a una ejecuci\u00f3n de c\u00f3digo remota"
    }
  ],
  "id": "CVE-2022-22951",
  "lastModified": "2024-11-21T06:47:40.273",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-03-23T20:15:10.797",
  "references": [
    {
      "source": "security@vmware.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.vmware.com/security/advisories/VMSA-2022-0008.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.vmware.com/security/advisories/VMSA-2022-0008.html"
    }
  ],
  "sourceIdentifier": "security@vmware.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2021-06-23 12:15
Modified
2024-11-21 05:49
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2 has an authentication bypass. A malicious actor with network access to the VMware Carbon Black App Control management server might be able to obtain administrative access to the product without the need to authenticate.
References
security@vmware.comhttps://www.vmware.com/security/advisories/VMSA-2021-0012.html?Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.vmware.com/security/advisories/VMSA-2021-0012.html?Patch, Vendor Advisory
Impacted products
Vendor Product Version
vmware carbon_black_app_control *
vmware carbon_black_app_control *
vmware carbon_black_app_control 8.0
vmware carbon_black_app_control 8.1


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:carbon_black_app_control:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CC7CE59E-6DDC-4961-B730-807CCC8C779D",
              "versionEndExcluding": "8.5.8",
              "versionStartIncluding": "8.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:carbon_black_app_control:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A144DAE2-DD1A-4C87-84DB-AA8DDED0A54D",
              "versionEndExcluding": "8.6.2",
              "versionStartIncluding": "8.6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:carbon_black_app_control:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "087EF879-DC09-45C0-844E-2DCC43A57A7E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:carbon_black_app_control:8.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "94C16231-F798-4566-B56C-F3FD6B804C98",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2 has an authentication bypass. A malicious actor with network access to the VMware Carbon Black App Control management server might be able to obtain administrative access to the product without the need to authenticate."
    },
    {
      "lang": "es",
      "value": "VMware Carbon Black App Control versiones 8.0, 8.1, 8.5 anteriores a 8.5.8 y versiones 8.6 anteriores a 8.6.2, presenta una omisi\u00f3n de autenticaci\u00f3n. Un actor malicioso con acceso de red al servidor de administraci\u00f3n de VMware Carbon Black App Control podr\u00eda obtener acceso administrativo al producto sin necesidad de autenticarse"
    }
  ],
  "id": "CVE-2021-21998",
  "lastModified": "2024-11-21T05:49:24.780",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-06-23T12:15:07.857",
  "references": [
    {
      "source": "security@vmware.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.vmware.com/security/advisories/VMSA-2021-0012.html?"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.vmware.com/security/advisories/VMSA-2021-0012.html?"
    }
  ],
  "sourceIdentifier": "security@vmware.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}