CVE-2024-22270

2024-05-1416:16:12

[email protected]

web.nvd.nist.gov

vmware

information disclosure

file sharing

vulnerability

administrative privileges

hypervisor memory

7.1 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

7.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.8%

JSON

VMware Workstation and Fusion contain an information disclosure vulnerability in the Host Guest File Sharing (HGFS) functionality. A malicious actor with local administrative privileges on a virtual machine may be able to read privileged information contained in hypervisor memory from a virtual machine.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows",
      "Linux"
    ],
    "product": "VMware Workstation",
    "vendor": "N/A",
    "versions": [
      {
        "lessThan": "17.5.2",
        "status": "affected",
        "version": "17.x",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "MacOS"
    ],
    "product": "VMware Fusion",
    "vendor": "N/A",
    "versions": [
      {
        "lessThan": "13.5.2",
        "status": "affected",
        "version": "13.x",
        "versionType": "custom"
      }
    ]
  }
]