CVE-2020-3977

2020-09-2213:45:14

vmware

www.cve.org

6.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.7%

JSON

VMware Horizon DaaS (7.x and 8.x before 8.0.1 Update 1) contains a broken authentication vulnerability due to a flaw in the way it handled the first factor authentication. Successful exploitation of this issue may allow an attacker to bypass two-factor authentication process. In order to exploit this issue, an attacker must have a legitimate account on Horizon DaaS.

CNA Affected

[
  {
    "product": "VMware Horizon DaaS",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "VMware Horizon DaaS (7.x and 8.x before 8.0.1 Update 1)"
      }
    ]
  }
]

References

www.vmware.com/security/advisories/VMSA-2020-0021.html