Risk | Low |
Patch available | NO |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2020-3980 |
CWE-ID | CWE-264 |
Exploitation vector | Local |
Public exploit | Public exploit code for vulnerability #1 is available. |
Vulnerable software Subscribe |
VMware Fusion Client/Desktop applications / Virtualization software |
Vendor | VMware, Inc |
This security bulletin contains one low risk vulnerability.
EUVDB-ID: #VU46759
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2020-3980
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: Yes
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to the way the affected software allows configuring the system wide path. A local user can trick an admin user into executing malicious code on the system where Fusion is installed.
MitigationCybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsVMware Fusion: 11.0.0 - 11.5.5
http://www.vmware.com/security/advisories/VMSA-2020-0020.html
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?