CVE-2018-6971: High severity vmware horizon view agent vulnerability
VMware Horizon View Agents (7.x.x before 7.5.1) contain a local information disclosure vulnerability due to insecure logging of credentials in the vmmsi.log file when an account other than the currently logged on user is specified during installation (including silent installations). Successful exploitation of this issue may allow low privileged users access to the credentials specified during the Horizon View Agent installation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-6971?
CVE-2018-6971 is categorized as a local information disclosure vulnerability.
How do I fix CVE-2018-6971?
To fix CVE-2018-6971, upgrade VMware Horizon View Agents to version 7.5.1 or later.
What products are affected by CVE-2018-6971?
CVE-2018-6971 affects VMware Horizon View Agents versions 7.x.x prior to 7.5.1.
What causes the CVE-2018-6971 vulnerability?
CVE-2018-6971 is caused by insecure logging of credentials in the vmmsi.log file during installation.
Can CVE-2018-6971 be exploited remotely?
No, CVE-2018-6971 is a local vulnerability that requires access to the machine where the software is installed.