CVE-2019-5543

7.8HIGH

Key Information:

Vendor
Vmware
Status
Vmware Horizon Client For Windows
Vmware Remote Console For Windows
Vmware Workstation For Windows
Vendor
CVE Published:
16 March 2020

Summary

For VMware Horizon Client for Windows (5.x and prior before 5.3.0), VMware Remote Console for Windows (10.x before 11.0.0), VMware Workstation for Windows (15.x before 15.5.2) the folder containing configuration files for the VMware USB arbitration service was found to be writable by all users. A local user on the system where the software is installed may exploit this issue to run commands as any user.

Affected Version(s)

VMware Horizon Client for Windows 5.x and prior before 5.3.0

VMware Remote Console for Windows 10.x before 11.0.0

VMware Workstation for Windows 15.x before 15.5.2

References

https://www.vmware.com/security/advisories/VMSA-2020-0004...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.