CVE-2020-3977: Medium severity vmware esxi and horizon daas vulnerability
VMware Horizon DaaS (7.x and 8.x before 8.0.1 Update 1) contains a broken authentication vulnerability due to a flaw in the way it handled the first factor authentication. Successful exploitation of this issue may allow an attacker to bypass two-factor authentication process. In order to exploit this issue, an attacker must have a legitimate account on Horizon DaaS.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-3977.
What is the severity of CVE-2020-3977?
The severity of CVE-2020-3977 is medium with a CVSS score of 6.5.
Which versions of VMware Horizon DaaS are affected by CVE-2020-3977?
VMware Horizon DaaS versions 7.x, 8.0.0, and 8.0.1 (before 8.0.1 Update 1) are affected by CVE-2020-3977.
What is the impact of CVE-2020-3977?
Successful exploitation of CVE-2020-3977 may allow an attacker to bypass two-factor authentication process.
Is there a fix available for CVE-2020-3977?
Yes, VMware has released a fix in the form of VMware Horizon DaaS 8.0.1 Update 1.