Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-3957

VMware Fusion (11.x before 11.5.5), VMware Remote Console for Mac (11.x and prior) and VMware Horizon Client for Mac (5.x and prior) contain a local privilege escalation vulnerability due to a Time-of-check Time-of-use (TOCTOU) issue in the service opener. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC and Horizon Client are installed.

Published

2020-05-29T20:15:11.547

Last Modified

2024-11-21T05:32:02.157

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.0 (HIGH)

CVSSv2 Vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

  • Access Vector: LOCAL
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

3.4

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-367
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application vmware fusion < 11.5.5 Yes
Application vmware horizon_client ≤ 5.4.0 Yes
Application vmware remote_console ≤ 11.0.1 Yes
Operating System apple macos - No
References