Nov 15, 2023NewsroomNetwork Securit / Vulnerability

VMware is warning of a critical and unpatched security flaw in Cloud Director that could be exploited by a malicious actor to get around authentication protections.

Tracked as CVE-2023-34060 (CVSS score: 9.8), the vulnerability impacts instances that have been upgraded to version 10.5 from an older version.

“On an upgraded version of VMware Cloud Director Appliance 10.5, a malicious actor with network access to the appliance can bypass login restrictions when authenticating on port 22 (ssh) or port 5480 (appliance management console),” the company said in an alert.

“This bypass is not present on port 443 (VCD provider and tenant login). On a new installation of VMware Cloud Director Appliance 10.5, the bypass is not present.”

The virtualization services company further noted that the impact is due to the fact that it utilizes a version of sssd from the underlying Photon OS that is affected by CVE-2023-34060.


Dustin Hartle from IT solutions provider Ideal Integrations has been credited with discovering and reporting the shortcomings.

While VMware has yet to release a fix for the problem, it has provided a workaround in the form of a shell script (“”).

It also emphasized implementing the temporary mitigation will neither require downtime nor have a side-effect on the functionality of Cloud Director installations.

The development comes weeks after VMware released patches for another critical flaw in the vCenter Server (CVE-2023-34048, CVSS score: 9.8) that could result in remote code execution on affected systems.

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

Products You May Like

Articles You May Like

Disneyland Unveils 2024 Event Schedule, Including Pixar Fest, Food & Wine Festival And Season Of The Force
Sunak suggests more tax cuts on the way – but refuses to commit to triple lock election pledge
Boat Climbs to Second Spot in Global Wearable Shipments in Q3 2023, Apple Leads the Way: IDC
Infinix Hot 40, Infinix Hot 40 Pro, Infinix Hot 40i With 5,000mAh Battery Launched: Price, Specifications
The Most Popular Audiobooks of 2023, According to

Leave a Reply

Your email address will not be published. Required fields are marked *