VMware has reported a critical vulnerability affecting products, VMware Cloud Director Appliance (VCD appliance), named CVE-2023-34060 classified as critical witha CVSSv3 score of 9.8, which affects the sssd component of the Photon OS™.

In an upgraded version of VMware Cloud Director Appliance 10.5 (upgraded from a previous version), a malicious actor with network access to the appliance can bypass login restrictions by authenticating on port 22 (ssh) or port 5480 (appliance management console).

This omission is not present on port 443 (VCD provider and tenant login). On a fresh installation of VMware Cloud Director Appliance version 10.5, the vulnerability is not present.