Information disclosure in VMware Horizon View Agent
CVE-2018-6971
VMware Horizon View Agents (7.x.x before 7.5.1) contain a local information disclosure vulnerability due to insecure logging of credentials in the vmmsi.log file when an account other than the currently logged on user is specified during installation (including silent installations). Successful exploitation of this issue may allow low privileged users access to the credentials specified during the Horizon View Agent installation.
EPSS: 0.004 (34.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Vmware Horizon View Agent — versions 7.x.x before 7.5.1
- Vmware Horizon_view_agents
Weakness classification (CWE)
References
- security@vmware.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
- security@vmware.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- security@vmware.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
- security@vmware.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2018-6971?
- CVE-2018-6971 is a high-severity vulnerability in VMware Horizon View Agent, classified under Insertion of Sensitive Information into Log File. CVSS score: 7.8/10. Published 2018-07-25.
- How severe is CVE-2018-6971?
- High severity. CVSS v3 base score is 7.8 out of 10.