Cloud computing and virtualization technology giant VMware on Tuesday rushed out an urgent patch for a gaping authentication bypass bug affecting its Cloud Director Appliance product.
The vulnerability, tagged as CVE-2023-34060, carries a CVSS severity-score of 9.8 out of 10 and can be exploited by a malicious actor with network access to the appliance to bypass login restrictions when authenticating on certain ports.
The company’s security response team said the code defect affects the VMware Cloud Director Appliance (VCD Appliance), specifically in instances where the appliance has been upgraded to version 10.5 from an older version.
“On a new installation of VMware Cloud Director Appliance 10.5, the bypass is not present,” according to a critical bulletin documenting the issue.
The company said the vulnerability originates from the underlying Photon OS but emphasized that other appliances are not impacted by the authentication bypass bug.
VMware is recommending that businesses using the Cloud Director Appliance follow its documented guidance to mitigate the issue.
Related: VMware vCenter Flaw So Critical, End-of-Life Products Patched
Related: Microsoft Warns of Critical Windows Bugs Being Exploited
Related: Adobe Patch Tuesday: Critical Bugs in Acrobat, Reader, ColdFusion
Related: Protected VMs Exposed to New ‘CacheWarp’ AMD CPU Attack