VMware Horizon View Agents (7.x.x before 7.5.1) contain a local information disclosure vulnerability due to insecure logging of credentials in the vmmsi.log file when an account other than the currently logged on user is specified during installation (including silent installations). Successful exploitation of this issue may allow low privileged users access to the credentials specified during the Horizon View Agent installation.
References
Link | Resource |
---|---|
http://www.securityfocus.com/bid/104883 | Third Party Advisory VDB Entry |
http://www.securitytracker.com/id/1041357 | Third Party Advisory VDB Entry |
http://www.securitytracker.com/id/1041358 | Third Party Advisory VDB Entry |
https://www.vmware.com/security/advisories/VMSA-2018-0018.html | Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: vmware
Published: 2018-07-19T00:00:00
Updated: 2018-07-27T09:57:01
Reserved: 2018-02-14T00:00:00
Link: CVE-2018-6971
JSON object: View
NVD Information
Status : Analyzed
Published: 2018-07-25T13:29:00.300
Modified: 2019-10-03T00:03:26.223
Link: CVE-2018-6971
JSON object: View
Redhat Information
No data.
CWE