7.8

CVE-2023-34045

VMware Fusion installer local privilege escalation

VMware Fusion(13.x prior to 13.5) contains a local privilege escalation vulnerability that occurs during 
installation for the first time (the user needs to drag or copy the 
application to a folder from the '.dmg' volume) or when installing an 
upgrade. A malicious actor with local non-administrative user privileges may 
exploit this vulnerability to escalate privileges to root on the system 
where Fusion is installed or being installed for the first time.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
VMware ≫ Fusion Version >= 13.0.0 < 13.5
   Apple ≫ macOS X Version-
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.12% 0.308
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
security@vmware.com 6.6 1.3 5.2
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.