CVE-2023-20855

State: Published
Severity: 8.8 High
Published: Feb 21, 2023
Updated: Mar 17, 2025
Reserved: Nov 1, 2022

Description

VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. A malicious actor, with non-administrative access to vRealize Orchestrator, may be able to use specially crafted input to bypass XML parsing restrictions leading to access to sensitive information or possible escalation of privileges.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-611 Improper Restriction of XML External Entity Reference

Affected Products

Product	Versions
VMware vRealize Orchestrator, VMware vRealize Automation, VMware Cloud Foundationn/a	VMware vRealize Orchestrator 8.xAffected

References

https://www.vmware.com/security/advisories/VMSA-2023-0005.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.