VMware issued an immediate patch to fix a severe security flaw in its Carbon Black App Control product

On Tuesday, VMware took action to prevent a major security breach with the release of patches for its Carbon Black App Control product. Tracked as CVE-2023-20858, this vulnerability carries an alarming CVSS score of 9.1/10 and affects versions 8.7.x, 8.8.x, and 8.9, Fortunately, it was discovered by  Jari Jääskelä before further damage could be done - this injection flaw posed a serious risk if left unaddressed! "A malicious actor with privileged access to the App Control administration console may be able to use specially crafted input allowing access to the underlying server operating system," the company said in an advisory.

VMware has stated that there are no potential solutions to the flaw, requiring customers to update their software versions 8.7.8, 8.8.6, and 8.9.4 in order to prevent any possible risks posed by the vulnerability present in the product (CVE-2022-22951 & CVE-2022-22952). It is worth noting that Jääskelä was credited for discovering these two critical vulnerabilities which were successfully addressed by VMware back in March of 2022 with a CVSS score of 9

To solidify their security, the company has patched an XML External Entity (XXE) Vulnerability (CVE-2023-20855, CVSS score: 8.8), which affected vRealize Orchestrator, vRealize Automation, and Cloud Foundation. "A malicious actor, with non-administrative access to vRealize Orchestrator, may be able to use specially crafted input to bypass XML parsing restrictions leading to access to sensitive information or possible escalation of privileges," VMware said. Threat actors often target VMware product vulnerabilities, so it is essential that users promptly apply necessary patches to ensure a secure environment.