Log in Start free

Actively exploited · Published Mar 17, 2020 · Assigned by vmware

CVE-2020-3950

High 7.8 Exploited

In plain English

A high-severity privilege mismanagement in VMware Fusion, VMware Remote Console for Mac and Horizon Client for Mac. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 7.3% (higher than 94% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. Apply updates per vendor instructions.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)7.3%top 5.6% of all CVEs
Exploited in the wildYesCISA KEV since Nov 3, 2021
Attack tooling1Metasploit

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 3, 2022.

Official description

VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability due to improper use of setuid binaries. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC or Horizon Client is installed.

Affected products (as reported)

VendorProductVersions
n/a VMware Fusion, VMware Remote Console for Mac and Horizon Client for Mac VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0)

Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References