Improper authorisation vulnerability (VMware Tools)
En bref
- Source
- NVD
- EPSS
- EPSS 0.28 % · centile 20 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- vmware
- Statut NVD
- Deferred
Rechercher sur…
Description
VMware Tools for Windows contains an improper authorisation vulnerability due to the way it handles user access controls. A malicious actor with non-administrative privileges on a guest VM, who is already authenticated through vCenter or ESX may exploit this issue to access other guest VMs. Successful exploitation requires knowledge of credentials of the targeted VMs and vCenter or ESX.
Faiblesses (CWE)
- CWE-863 — Autorisation incorrecte
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.6 | CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H | vmware |
| CVSS 3.1 | HIGH 7.6 | CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H | NVD · security@vmware.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2025-31579
- GCVE · GCVE-0-2025-41246
Avis du CERT-FR
- CERTFR-2025-AVI-0832 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| VMware · Tools | affected 13.x.x.x < 13.0.5.0 ; affected 12.x.x < 12.5.4 ; affected 11.x.x |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |