Insufficient Granularity of Access Control Affecting open-vm-tools-test package, versions <0:11.0.5-3.el7_9.9


Severity

Recommended
0.0
high
0
10

Based on CentOS security rating.

Threat Intelligence

EPSS
0.1% (43rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CENTOS7-OPENVMTOOLSTEST-6040776
  • published31 Oct 2023
  • disclosed26 Oct 2023

Introduced: 26 Oct 2023

CVE-2023-34058  (opens in a new tab)
CWE-1220  (opens in a new tab)

How to fix?

Upgrade Centos:7 open-vm-tools-test to version 0:11.0.5-3.el7_9.9 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream open-vm-tools-test package and not the open-vm-tools-test package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html  in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .

CVSS Scores

version 3.1