CVE-2020-3964

Katalog CVE

CVSS 4.7 · Medium EPSS 0,47%

Kerentanan Use of Uninitialized Resource pada vmware cloud foundation, vmware fusion +2 lainnya. Skor CVSS 3.1 4.7 (Medium) menurut NVD.

Deskripsi (NVD)

VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.2), and Fusion (11.x before 11.5.2) contain an information leak in the EHCI USB controller. A malicious actor with local access to a virtual machine may be able to read privileged information contained in the hypervisor's memory. Additional conditions beyond the attacker's control need to be present for exploitation to be possible.

Rincian

Terbit di NVD

25 Juni 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.7 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-908: Use of Uninitialized Resource

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 39,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 190 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://www.vmware.com/security/advisories/VMSA-2020-0015.html advisory vendor
• http://packetstormsecurity.com/files/158459/VMware-ESXi-Use-After-Free-Out-Of-Bounds-Access.html exploit · advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2020/Jul/22 mailing list · advisory pihak ketiga