by Kastro
Paper/Archive/CVE-2020-3943

CVE-2020-3943

VMWare vRealize Operations for Horizon Adapter — vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) uses a JMX RMI service which is not securely conf…

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 83.5.835 × 2016.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) uses a JMX RMI service which is not securely configured. An unauthenticated remote attacker who has network access to vRealize Operations, with the Horizon Adapter running, may be able to execute arbitrary code in vRealize Operations.

Affected

ProductAffectedFixed inSource
vRealize Operations for Horizon Adapter6.7.x prior to 6.7.1–CNA
vRealize Operations for Horizon Adapter6.6.x prior to 6.6.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refvmware.com/security/advisories/VMSA-2020-0003.html