CVE-2020-3980 : VMware Fusion (11.x) contains a privilege escalation vulnerability due to the wa

VMware Fusion (11.x) contains a privilege escalation vulnerability due to the way it allows configuring the system wide path. An attacker with normal user privileges may exploit this issue to trick an admin user into executing malicious code on the system where Fusion is installed.

Published 2020-09-16 17:15:14

Updated 2021-07-21 11:39:24

Source VMware

View at NVD, CVE.org

Vulnerability category: Gain privilege

Products affected by CVE-2020-3980

Vmware » Fusion
Versions from including (>=) 11.0.0 and before (<) 12.0.0
cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Mac Os X » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2020-3980

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 10 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-3980

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
3.7	LOW	AV:L/AC:H/Au:N/C:P/I:P/A:P	1.9	6.4	NIST
Access Vector: Local Access Complexity: High Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
6.7	MEDIUM	CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H	0.8	5.9	NIST
Attack Vector: Local Attack Complexity: High Privileges Required: Low User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

References for CVE-2020-3980

https://www.vmware.com/security/advisories/VMSA-2020-0020.html

VMSA-2020-0020
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2020-3980

Products affected by CVE-2020-3980

Exploit prediction scoring system (EPSS) score for CVE-2020-3980

CVSS scores for CVE-2020-3980

References for CVE-2020-3980