Permissions, Privileges, and Access Controls in Cloud Foundation and VMware ESXi - CVE-2020-4005
Published: November 20, 2020 / Updated: November 23, 2020
Vulnerability identifier: #VU48603
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-4005
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions, which leads to security restrictions bypass and privilege escalation.
Affected software
Cloud Foundation
VMware ESXi
Dell Enterprise Hybrid Cloud
Dell EMC VxRail Appliance
VMware ESXi
Dell Enterprise Hybrid Cloud
Dell EMC VxRail Appliance
How to mitigate CVE-2020-4005
Install updates from vendor's website.
VMware ESXi - addressed in versions ESXi650-202011301-SG, ESXi670-202011101-SG, ESXi70U1b-17168206
Dell Enterprise Hybrid Cloud - update to 4.1.2
Dell EMC VxRail Appliance - addressed in versions 4.5.452, 4.7.525, 7.0.101
Dell Enterprise Hybrid Cloud - update to 4.1.2
Dell EMC VxRail Appliance - addressed in versions 4.5.452, 4.7.525, 7.0.101