Horizon DaaS update addresses a broken authentication issue

VMware Horizon DaaS

Broken authentication issue in Horizon DaaS

Horizon DaaS contains a broken authentication vulnerability that may allow an attacker to bypass two-factor authentication. Note: In order to exploit this issue, an attacker must have a legitimate account on Horizon DaaS.

VMware would like to thank Peter Ivezaj, President - Digital Upkeep for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2018-6960 to this issue.

Column 5 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.