Vulnerability Intelligence Report
CVE-2018-6971
VMware Horizon View Agents (7.x.x before 7.5.1) contain a local information disclosure vulnerability due to insecure logging of credentials in the vmmsi.log file when an account other than the currently logged on user is specified during installation (including silent installations). Successful exploitation of this issue may allow low privileged users access to the credentials specified during the Horizon View Agent installation.
No Active Exploit Signals
CVSS Base Score
7.8
HIGH
EPSS Probability:0.42%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| VMware | Horizon View Agent | 7.x.x before 7.5.1 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.417%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | VMware by Broadcom · Vendor · USA |
| Reserved | 2018-02-14T00:00:00 |
| Published | 2018-07-25T13:00:00 |
| Patch Date | 2018-07-19 |
| Last Updated | 2024-09-17T03:39:03 |
Community Chatter & Buzz