VMware Fusion, VMware Remote Console for Mac and Horizon Client for Mac
At a glance
- Source
- NVD
- EPSS
- EPSS 0.37 % · percentile 31 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- vmware
- NVD status
- Modified
Description
VMware Fusion (11.x before 11.5.5), VMware Remote Console for Mac (11.x and prior before 11.2.0 ) and Horizon Client for Mac (5.x and prior before 5.4.3) contain a privilege escalation vulnerability due to improper XPC Client validation. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMware Remote Console for Mac or Horizon Client for Mac is installed.
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2020-25239
- GCVE · GCVE-0-2020-3974
CERT-FR advisories
- CERTFR-2020-AVI-425 — Vulnérabilité dans les produits VMware · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:*≥ 11.0.0 < 11.5.5cpe:2.3:a:vmware:horizon_client:*:*:*:*:*:*:*:*≥ 5.0.0 < 5.4.3cpe:2.3:a:vmware:remote_console:*:*:*:*:*:*:*:*≥ 11.0.0 < 11.2.0
Affected products
| Product | Versions |
|---|---|
| VMware Fusion, VMware Remote Console for Mac and Horizon Client for Mac | affected VMware Fusion (11.x before 11.5.5), VMware Remote Console for Mac (11.x and prior before 11.2.0 ) and Horizon Client for Mac (5.x and prior before 5.4.3) |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |