CVE-2018-6971
First published: Wed Jul 25 2018(Updated: )
VMware Horizon View Agents (7.x.x before 7.5.1) contain a local information disclosure vulnerability due to insecure logging of credentials in the vmmsi.log file when an account other than the currently logged on user is specified during installation (including silent installations). Successful exploitation of this issue may allow low privileged users access to the credentials specified during the Horizon View Agent installation.
Credit: security@vmware.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| VMware Horizon View Agents | >=7.0.0<7.5.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2018-6971?
CVE-2018-6971 is categorized as a local information disclosure vulnerability.
How do I fix CVE-2018-6971?
To fix CVE-2018-6971, upgrade VMware Horizon View Agents to version 7.5.1 or later.
What products are affected by CVE-2018-6971?
CVE-2018-6971 affects VMware Horizon View Agents versions 7.x.x prior to 7.5.1.
What causes the CVE-2018-6971 vulnerability?
CVE-2018-6971 is caused by insecure logging of credentials in the vmmsi.log file during installation.
Can CVE-2018-6971 be exploited remotely?
No, CVE-2018-6971 is a local vulnerability that requires access to the machine where the software is installed.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- agent/author
- agent/severity
- agent/weakness
- agent/description
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- vendor/vmware
- canonical/vmware horizon view agents
- version/vmware horizon view agents/7.0.0