7.0high
CVE-2018-6969
VMware Tools (10.x and prior before 10.3.0) contains an out-of-bounds read vulnerability in HGFS.
Published 8 y ago · modified 4 mo ago · JSON
CVSS
7.0
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 34%
Public exploits
0
none known
Summary
VMware Tools (10.x and prior before 10.3.0) contains an out-of-bounds read vulnerability in HGFS. Successful exploitation of this issue may lead to information disclosure or may allow attackers to escalate their privileges on the guest VMs. In order to be able to exploit this issue, file sharing must be enabled.
Exploit prediction (EPSS)
0.40% probability of exploitation in the next 30 days, higher than 34% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.0 | CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 4.4 | AV:L/AC:M/Au:N/C:P/I:P/A:P |
Affected products
- VMware VMware Tools
Classification
- Weakness
- CWE-125 Out-of-bounds Read
- Technology feeds
- VMware (RSS, critical only)
References
- securitytracker.com /id/1041291 · vdb-entry, x_refsource_SECTRACK, x_transferred
- vmware.com /security/advisories/VMSA-2018-0017.html · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/104737 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2018-6969
- NVD: CVE-2018-6969
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.