vulnwire
7.8high

CVE-2018-6971

VMware Horizon View Agents (7.x.x before 7.5.1) contain a local information disclosure vulnerability due to insecure logging of credentials…

Published 8 y ago · modified 4 mo ago · JSON

CVSS
7.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 36%
Public exploits
0
none known

VMware Horizon View Agents (7.x.x before 7.5.1) contain a local information disclosure vulnerability due to insecure logging of credentials in the vmmsi.log file when an account other than the currently logged on user is specified during installation (including silent installations). Successful exploitation of this issue may allow low privileged users access to the credentials specified during the Horizon View Agent installation.

Exploit prediction (EPSS)

0.42% probability of exploitation in the next 30 days, higher than 36% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.07.8CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD2.02.1AV:L/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • VMware Horizon View Agent

Classification

Weakness
  • CWE-532 Insertion of Sensitive Information into Log File

References

  • securitytracker.com /id/1041357 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • securityfocus.com /bid/104883 · vdb-entry, x_refsource_BID, x_transferred
  • securitytracker.com /id/1041358 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • vmware.com /security/advisories/VMSA-2018-0018.html · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.