{"id":"CVE-2023-20900","title":"A malicious actor that has been granted  Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html  in a target virtual machine may be able to elevate their p…","summary":"A malicious actor that has been granted  Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html  in a target virtual machine may be able to elevate their p…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-294","CWE-347"],"vendor":"vmware","product":"tools","affected":["tools >= 10.3.0, < 12.3.0","tools >= 10.3.0, < 10.3.26","open_vm_tools >= 10.3.0, < 12.3.0","fedora = 37","fedora = 38","fedora = 39","debian_linux = 10.0","debian_linux = 11.0","debian_linux = 12.0","ontap_select_deploy_administration_utility"],"patched":["tools 10.3.26","open_vm_tools 12.3.0"],"published":"2023-08-31","updated":"2026-10-08","sourceUpdated":"2026-10-08T22:17:22.590","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-20900","references":[{"url":"http://www.openwall.com/lists/oss-security/2023/08/31/1","label":"security@vmware.com"},{"url":"http://www.openwall.com/lists/oss-security/2023/10/27/1","label":"security@vmware.com"},{"url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00000.html","label":"security@vmware.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NVKQ6Y2JFJRWPFOZUOTFO3H27BK5GGOG/","label":"security@vmware.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJNJMD67QIT6LXLKWSHFM47DCLRSMT6W/","label":"security@vmware.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZJM6HDRQYS74JA7YNKQBFH2XSZ52HEWH/","label":"security@vmware.com"},{"url":"https://security.netapp.com/advisory/ntap-20231013-0002/","label":"security@vmware.com"},{"url":"https://www.debian.org/security/2023/dsa-5493","label":"security@vmware.com"},{"url":"https://www.vmware.com/security/advisories/VMSA-2023-0019.html","label":"security@vmware.com"},{"url":"http://www.openwall.com/lists/oss-security/2023/08/31/1","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2023/10/27/1","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00000.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NVKQ6Y2JFJRWPFOZUOTFO3H27BK5GGOG/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJNJMD67QIT6LXLKWSHFM47DCLRSMT6W/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZJM6HDRQYS74JA7YNKQBFH2XSZ52HEWH/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20231013-0002/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2023/dsa-5493","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.vmware.com/security/advisories/VMSA-2023-0019.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-20900.json"},{"url":"https://access.redhat.com/security/cve/CVE-2023-20900"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236542"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-20900"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-20900"},{"url":"https://github.com/vmware/open-vm-tools/blob/CVE-2023-20900.patch/CVE-2023-20900.patch"},{"url":"https://access.redhat.com/errata/RHSA-2023:5217"},{"url":"https://access.redhat.com/errata/RHSA-2024:5315"},{"url":"https://access.redhat.com/errata/RHSA-2023:5213"},{"url":"https://access.redhat.com/errata/RHSA-2023:5210"},{"url":"https://access.redhat.com/errata/RHSA-2023:5216"},{"url":"https://access.redhat.com/errata/RHSA-2023:5220"},{"url":"https://access.redhat.com/errata/RHSA-2023:5312"},{"url":"https://access.redhat.com/errata/RHSA-2023:5218"},{"url":"https://access.redhat.com/errata/RHSA-2023:5313"}],"tags":["nvd","csaf","vex","red-hat","cve.org"],"epss":0.01475,"epssPercentile":0.73691,"ingestedAt":"2026-10-08T23:16:47.351Z","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-08T21:06:58.363980Z"},"slug":"CVE-2023-20900","body":"## Overview\n\nA malicious actor that has been granted  Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html  in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged  Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .\n\n## Affected\n\n- `tools >= 10.3.0, < 12.3.0`\n- `tools >= 10.3.0, < 10.3.26`\n- `open_vm_tools >= 10.3.0, < 12.3.0`\n- `fedora = 37`\n- `fedora = 38`\n- `fedora = 39`\n- `debian_linux = 10.0`\n- `debian_linux = 11.0`\n- `debian_linux = 12.0`\n- `ontap_select_deploy_administration_utility`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `tools 10.3.26`\n- `open_vm_tools 12.3.0`\n\n## Vendor advisories\n\n- **RHSA-2023:5217** · Red Hat · fixed in: Red Hat Enterprise Linux Client (v. 7), Red Hat Enterprise Linux Client Optional (v. 7), Red Hat Enterprise Linux ComputeNode Optional (v. 7), Red Hat Enterprise Linux Server (v. 7), Red Hat Enterprise Linux Server Optional (v. 7), Red Hat Enterprise Linux Workstation (v. 7), … · released 2023-09-19 · [advisory](https://access.redhat.com/errata/RHSA-2023:5217)\n- **RHSA-2024:5315** · Red Hat · fixed in: Red Hat Enterprise Linux Server AUS (v. 7.7), Red Hat Enterprise Linux Server Optional AUS (v. 7.7) · released 2024-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2024:5315)\n- **RHSA-2023:5213** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v. 8.1) · released 2023-09-19 · [advisory](https://access.redhat.com/errata/RHSA-2023:5213)\n- **RHSA-2023:5210** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v. 8.2), Red Hat Enterprise Linux AppStream E4S (v. 8.2), Red Hat Enterprise Linux AppStream TUS (v. 8.2) · released 2023-09-19 · [advisory](https://access.redhat.com/errata/RHSA-2023:5210)\n- **RHSA-2023:5216** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream E4S (v.8.4), Red Hat Enterprise Linux AppStream TUS (v.8.4) · released 2023-09-19 · [advisory](https://access.redhat.com/errata/RHSA-2023:5216)\n- **RHSA-2023:5220** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.8.6) · released 2023-09-19 · [advisory](https://access.redhat.com/errata/RHSA-2023:5220)\n- **RHSA-2023:5312** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2023-09-20 · [advisory](https://access.redhat.com/errata/RHSA-2023:5312)\n- **RHSA-2023:5218** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.0) · released 2023-09-19 · [advisory](https://access.redhat.com/errata/RHSA-2023:5218)\n- **RHSA-2023:5313** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2023-09-20 · [advisory](https://access.redhat.com/errata/RHSA-2023:5313)","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}