- Description
- VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability due to improper use of setuid binaries. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC or Horizon Client is installed.
- Source
- security@vmware.com
- NVD status
- Modified
CVSS 3.1
- Type
- Primary
- Base score
- 7.8
- Impact score
- 5.9
- Exploitability score
- 1.8
- Vector string
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
CVSS 2.0
- Type
- Primary
- Base score
- 7.2
- Impact score
- 10
- Exploitability score
- 3.9
- Vector string
- AV:L/AC:L/Au:N/C:C/I:C/A:C
Data from CISA
- Vulnerability name
- VMware Multiple Products Privilege Escalation Vulnerability
- Exploit added on
- Nov 3, 2021
- Exploit action due
- May 3, 2022
- Required action
- Apply updates per vendor instructions.
- Hype score
- Not currently trending
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A7448F9A-9D9B-47BC-ACD1-18199A70D148",
"versionEndExcluding": "11.5.2",
"versionStartIncluding": "11.0.0"
},
{
"criteria": "cpe:2.3:a:vmware:horizon_client:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4F835663-B6E8-41FB-BDE0-C847E9086448",
"versionEndExcluding": "5.4.0",
"versionStartIncluding": "5.0.0"
},
{
"criteria": "cpe:2.3:a:vmware:remote_console:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7395721C-7903-4336-AD4C-D5544CF4AC10",
"versionEndExcluding": "11.0.1",
"versionStartIncluding": "11.0.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
]