CVE-2019-5543

Published: Mar 16, 2020Modified: Nov 21, 2024

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

For VMware Horizon Client for Windows (5.x and prior before 5.3.0), VMware Remote Console for Windows (10.x before 11.0.0), VMware Workstation for Windows (15.x before 15.5.2) the folder containing configuration files for the VMware USB arbitration service was found to be writable by all users. A local user on the system where the software is installed may exploit this issue to run commands as any user.

Affected (3)

Products: Vmware: Horizon Client, Remote Console, Workstation

3 products

Configuration A

3 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Vmware Horizon Client	From 5.0.0 to 5.3.0
Vmware Remote Console	From 10.0.0 to 11.0.0
Vmware Workstation	From 15.0.0 to 15.5.2

Running on/with	Platform Versions
Microsoft Windows	All versions

Related CWEs

Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References (2)

https://www.vmware.com/security/advisories/VMSA-2020-0004.html

Source: security@vmware.com

Vendor Advisory

https://www.vmware.com/security/advisories/VMSA-2020-0004.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.