CVEFinder.io

CVE-2023-34057

⚠️ high
🔍 Scan for this CVE
Summary

VMware Tools contains a local privilege escalation vulnerability. A malicious actor with local user access to a guest virtual machine may elevate privileges within the virtual machine.

CVSS Score
7.8
High
EPSS Score
0.1
Exploit Probability
Published Date
2023-10-27
First Seen: 2026-01-05
📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 70.1% of all 318,332 vulnerabilities in our database.

#95,275
Above average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Mar 6, 2025
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
SSVC data provided by CISA
Last Modified 2025-03-06
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE IDs (Weakness Types)
CWE-269

📦 Affected Products 1

Vendor Product Status Affected Versions
vmware tools Affected
≥ 10.3.0 < 12.1.1

🔗 References 1

https://www.vmware.com/security/advisories/VMSA-2023...
Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2025-41246 ⚠️ high 7.6 0.1 VMware Tools for Windows contains an improper authorisation vulnerability due to the way it handles user access control... 2025-09-29
CVE-2025-41244 ⚠️ high 7.8 1.0 VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor wit... 2025-09-29
CVE-2025-41239 ⚠️ high 7.1 0.0 VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure vulnerability due to the usage of ... 2025-07-15
CVE-2023-34058 ⚠️ high 7.1 0.0 VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Opera... 2023-10-27
CVE-2023-20900 ⚠️ high 7.1 0.8 A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vspher... 2023-08-31
CVE-2023-20867 ℹ️ low 3.9 3.0 A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the con... 2023-06-13
These CVEs affect the same products