Read the docs
TI-2023-16926 Aliases CVE-2023-34060GHSA-w4pv-p6xf-qc53

Missing authentication in VMware Cloud Director Appliance

Priority MEDIUM 52CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-306.

Summary

VMware Cloud Director Appliance contains an authentication bypass vulnerability in case VMware Cloud Director Appliance was upgraded to 10.5 from an older version. On an upgraded version of VMware Cloud Director Appliance 10.5, a malicious actor with network access to the appliance can bypass login restrictions when authenticating on port 22 (ssh) or port 5480 (appliance management console) . This bypass is not present on port 443 (VCD provider and tenant login). On a new installation of VMware Cloud Director Appliance 10.5, the bypass is not present. VMware Cloud Director Appliance is impacted since it uses an affected version of sssd from the underlying Photon OS. The sssd issue is no longer present in versions of Photon OS that ship with sssd-2.8.1-11 or higher (Photon OS 3) or sssd-2.8.2-9 or higher (Photon OS 4 and 5).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01345 71st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—VMware Cloud Director Appliance (VCD Appliance)10.5 if upgraded from 10.4.x or below.—No fix listedCNA
  • VMware Cloud Director Appliance (VCD Appliance) Vendor— Affected 10.5 if upgraded from 10.4.x or below. Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:vmware:cloud_director:*:*:*:*:*:*:*:*before 10.5VulnerableVMware
cpe:2.3:o:vmware:photon_os:-:*:*:*:*:*:*:*not specified by NVDRunning onVMware
  • cpe:2.3:a:vmware:cloud_director:*:*:*:*:*:*:*:* Versions before 10.5 Vulnerable ·VMware
  • cpe:2.3:o:vmware:photon_os:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·VMware

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-34060
  2. 2026-10-03 Alias added: GHSA-w4pv-p6xf-qc53

References

Advisory 4

  • TI-2024-14864 Cross-site scripting in VMware Cloud Director Availability CVSS 3.1MEDIUM 6.4
  • TI-2024-14844 VMware Cloud Director contains a partial information disclosure vulnerability. CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences