Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-wh96-x644-cvgj

Опубликовано: 24 мая 2022
Источник: github
Github: Не прошло ревью
CVSS3: 4.7

Описание

VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.2), and Fusion (11.x before 11.5.2) contain an information leak in the EHCI USB controller. A malicious actor with local access to a virtual machine may be able to read privileged information contained in the hypervisor's memory. Additional conditions beyond the attacker's control need to be present for exploitation to be possible.

VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.2), and Fusion (11.x before 11.5.2) contain an information leak in the EHCI USB controller. A malicious actor with local access to a virtual machine may be able to read privileged information contained in the hypervisor's memory. Additional conditions beyond the attacker's control need to be present for exploitation to be possible.

EPSS

Процентиль: 30%
0.00114
Низкий

4.7 Medium

CVSS3

Дефекты

CWE-200
CWE-908

Связанные уязвимости

CVSS3: 4.7
nvd
больше 5 лет назад

VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.2), and Fusion (11.x before 11.5.2) contain an information leak in the EHCI USB controller. A malicious actor with local access to a virtual machine may be able to read privileged information contained in the hypervisor's memory. Additional conditions beyond the attacker's control need to be present for exploitation to be possible.

CVSS3: 4.7
fstec
больше 5 лет назад

Уязвимость USB контроллера EHCI гипервизоров VMware ESXi, VMware Workstation и VMware Fusion, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

EPSS

Процентиль: 30%
0.00114
Низкий

4.7 Medium

CVSS3

Дефекты

CWE-200
CWE-908