CVE-2020-3950

Katalog CVE

CVSS 7.8 · High KEV · sudah dieksploitasi EPSS 7,3%

Kerentanan Improper Privilege Management pada vmware fusion, vmware horizon client +1 lainnya. Skor CVSS 3.1 7.8 (High) menurut NVD. Masuk katalog KEV CISA pada 3 November 2021, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability due to improper use of setuid binaries. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC or Horizon Client is installed.

Rincian

Terbit di NVD

17 Maret 2020

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management

EPSS (30 hari)

7,3% peluang dieksploitasi; lebih tinggi dari 94,2% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

VMware Multiple Products Privilege Escalation Vulnerability

Masuk KEV

3 November 2021

Tenggat CISA

3 Mei 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.vmware.com/security/advisories/VMSA-2020-0005.html advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3950 pemerintah AS
• http://packetstormsecurity.com/files/156843/VMware-Fusion-11.5.2-Privilege-Escalation.html exploit · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/157079/VMware-Fusion-USB-Arbitrator-Setuid-Privilege-Escalation.html exploit · advisory pihak ketiga · vdb entry