← Voltar para CVEs

CVE-2020-3950

HIGHCISA KEV

7.8

Descricao

VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability due to improper use of setuid binaries. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC or Horizon Client is installed.

Detalhes CVE

Pontuacao CVSS v3.17.8

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vetor de ataqueLOCAL

ComplexidadeLOW

Privilegios necessariosLOW

Interacao do usuarioNONE

Publicado3/17/2020

Ultima modificacao10/30/2025

Fontekev

Avistamentos honeypot0

CISA KEV

FornecedorVMware

ProdutoMultiple Products

Nome da vulnerabilidadeVMware Multiple Products Privilege Escalation Vulnerability

Data inclusao KEV2021-11-03

Prazo de remediacao2022-05-03

Uso em ransomwareUnknown

Produtos afetados

apple:macosvmware:fusionvmware:horizon_clientvmware:remote_console

Fraquezas (CWE)

CWE-269CWE-269

Referencias

http://packetstormsecurity.com/files/156843/VMware-Fusion-11.5.2-Privilege-Escalation.html(security@vmware.com)

http://packetstormsecurity.com/files/157079/VMware-Fusion-USB-Arbitrator-Setuid-Privilege-Escalation.html(security@vmware.com)

https://www.vmware.com/security/advisories/VMSA-2020-0005.html(security@vmware.com)

http://packetstormsecurity.com/files/156843/VMware-Fusion-11.5.2-Privilege-Escalation.html(af854a3a-2127-422b-91ae-364da2661108)

http://packetstormsecurity.com/files/157079/VMware-Fusion-USB-Arbitrator-Setuid-Privilege-Escalation.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.vmware.com/security/advisories/VMSA-2020-0005.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3950(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.