NetSight
IP …
high7.8Known exploitedPublic exploit code

CVE-2020-3950

VMware Multiple Products Privilege Escalation Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-11-03. Federal due date: 2022-05-03.

Apply updates per vendor instructions.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability due to improper use of setuid binaries. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC or Horizon Client is installed.

Affected products

VendorProductAffected versions
VmwareFusion
from 11.0.0 before 11.5.2
VmwareHorizon Client
from 5.0.0 before 5.4.0
VmwareRemote Console
from 11.0.0 before 11.0.1

Weakness classification

CWE-269

References