PT-2020-3954 · Vmware · Vmware Fusion

Published 2020-09-14 · Updated 2021-07-21 · CVE-2020-3980

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: VMware Fusion versions 11.x

Description: The issue is related to a privilege escalation vulnerability due to the way VMware Fusion configures the system-wide path. An attacker with normal user privileges may exploit this issue to trick an admin user into executing malicious code on the system where Fusion is installed. The vulnerability is associated with errors in privilege management, which can allow an attacker to elevate their privileges.

Recommendations: For VMware Fusion version 11.x, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2020-04347

CVE-2020-3980

Affected Products

Vmware Fusion

References · 5

• https://vmware.com/security/advisories/VMSA-2020-0020.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04347 · Security Note
• https://osv.dev/vulnerability/CVE-2020-3980 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3980 · Security Note
• https://cybersecurity-help.cz/vdb/SB2020091634 · Note