Vulnerability in Apple macOS
CVE-2020-3974
VMware Fusion (11.x before 11.5.5), VMware Remote Console for Mac (11.x and prior before 11.2.0 ) and Horizon Client for Mac (5.x and prior before 5.4.3) contain a privilege escalation vulnerability due to improper XPC Client validation. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMware Remote Console for Mac or Horizon Client for Mac is installed.
EPSS: 0.004 (28.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apple Macos
- Vmware Fusion
- Vmware Horizon_client
- Vmware Remote_console
- N/a Vmware Fusion, Remote Console For Mac And Horizon Client — versions VMware Fusion (11.x before 11.5.5), VMware Remote Console for Mac (11.x and prior before 11.2.0 ) and Horizon Client for Mac (5.x and prior before 5.4.3)
References
- security@vmware.com (Patch, x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-3974?
- CVE-2020-3974 is a high-severity vulnerability in Apple macOS. CVSS score: 7.8/10. Published 2020-07-10.
- How severe is CVE-2020-3974?
- High severity. CVSS v3 base score is 7.8 out of 10.