Skip to content
Fencer Intel
high 8.4

CVE-2023-20854 json

VMware Workstation contains an arbitrary file deletion vulnerability.

published 3y ago modified 4mo ago also EUVD-2023-25033

cvss
8.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 23%
public exploits
0
none known

Summary

VMware Workstation contains an arbitrary file deletion vulnerability. A malicious actor with local user privileges on the victim's machine may exploit this vulnerability to delete arbitrary files from the file system of the machine on which Workstation is installed.

Patch / fix

Is CVE-2023-20854 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
last yr.

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-14).

CVSS scores

assigned by version score vector
CISA ADP 3.1 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
NVD 3.1 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
CNA 3.1 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Affected products

  • n/a VMware Workstation

Classification

Weakness
  • CWE-269 Improper Privilege Management
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.