1. Affected Products
    • Aria Operations for Networks
  2. Overview
    • VMware has received responsible reports of multiple vulnerabilities in Aria Operations for Networks. Updates have been made available to address these vulnerabilities in VMware products that are affected.

3a. Vulnerability: Aria Operations for Networks Authentication Bypass (CVE-2023-34039)

  • Description: Aria Operations for Networks is susceptible to an Authentication Bypass vulnerability stemming from the absence of unique cryptographic key generation. VMware rates the severity of this issue as critical, with a maximum CVSSv3 base score of 9.8.
  • Attack Vectors: A malicious actor with network access to Aria Operations for Networks can exploit this vulnerability to bypass SSH authentication and gain unauthorized access to the Aria Operations for Networks CLI.
  • Resolution: To mitigate CVE-2023-34039, please apply the updates listed in the ‘Fixed Version’ column of the ‘Response Matrix’ provided below.
  • Workarounds: No workarounds available.
  • Additional Documentation: None.
  • Notes: CVE-2023-34039 impacts Aria Operations for Networks collectors, but upgrading the platform appliance resolves this issue. It’s worth noting that exploit code for CVE-2023-34039 has been publicly disclosed.
  • Acknowledgements: VMware expresses gratitude to Harsh Jaiswal and Rahul Maini from ProjectDiscovery Research for responsibly reporting this issue.

3b. Vulnerability: Aria Operations for Networks Arbitrary File Write (CVE-2023-20890)