Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-3999

VMware ESXi (7.0 prior to ESXi70U1c-17325551), VMware Workstation (16.x prior to 16.0 and 15.x prior to 15.5.7), VMware Fusion (12.x prior to 12.0 and 11.x prior to 11.5.7) and VMware Cloud Foundation contain a denial of service vulnerability due to improper input validation in GuestInfo. A malicious actor with normal user privilege access to a virtual machine can crash the virtual machine's vmx process leading to a denial of service condition.

Published

2020-12-21T16:15:13.177

Last Modified

2025-08-08T10:32:53.753

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:N/I:N/A:P

  • Access Vector: LOCAL
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: PARTIAL
Exploitability Score

3.9

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-20
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application vmware workstation < 15.5.7 Yes
Operating System vmware esxi 7.0 Yes
Operating System vmware esxi 7.0 Yes
Operating System vmware esxi 7.0 Yes
Operating System vmware esxi 7.0 Yes
Operating System vmware esxi 7.0 Yes
Application vmware fusion < 11.5.7 Yes
Operating System apple mac_os_x - No
References