Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-34046

VMware Fusion(13.x prior to 13.5) contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during installation for the first time (the user needs to drag or copy the application to a folder from the '.dmg' volume) or when installing an upgrade. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed or being installed for the first time.

Published

2023-10-20T09:15:12.717

Last Modified

2025-03-07T19:15:35.433

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.7 (MEDIUM)

Weaknesses
  • Type: Primary
    CWE-367
  • Type: Secondary
    CWE-367
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application vmware fusion < 13.5 Yes
Operating System apple mac_os_x - No
References