Vulnerability Details CVE-2020-3999
VMware ESXi (7.0 prior to ESXi70U1c-17325551), VMware Workstation (16.x prior to 16.0 and 15.x prior to 15.5.7), VMware Fusion (12.x prior to 12.0 and 11.x prior to 11.5.7) and VMware Cloud Foundation contain a denial of service vulnerability due to improper input validation in GuestInfo. A malicious actor with normal user privilege access to a virtual machine can crash the virtual machine's vmx process leading to a denial of service condition.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 35.2%
CVSS Severity
CVSS v3 Score 6.5
CVSS v2 Score 2.1
References
Products affected by CVE-2020-3999
-
cpe:2.3:a:vmware:fusion:11.5.0
-
cpe:2.3:a:vmware:fusion:11.5.1
-
cpe:2.3:a:vmware:fusion:11.5.2
-
cpe:2.3:a:vmware:fusion:11.5.3
-
cpe:2.3:a:vmware:fusion:11.5.5
-
cpe:2.3:a:vmware:fusion:11.5.6
-
cpe:2.3:a:vmware:workstation:15.0.0
-
cpe:2.3:a:vmware:workstation:15.0.1
-
cpe:2.3:a:vmware:workstation:15.0.2
-
cpe:2.3:a:vmware:workstation:15.0.3
-
cpe:2.3:a:vmware:workstation:15.0.4
-
cpe:2.3:a:vmware:workstation:15.1.0
-
cpe:2.3:a:vmware:workstation:15.5.0
-
cpe:2.3:a:vmware:workstation:15.5.1
-
cpe:2.3:a:vmware:workstation:15.5.2
-
cpe:2.3:a:vmware:workstation:15.5.5
-
cpe:2.3:a:vmware:workstation:15.5.6
-
cpe:2.3:o:apple:mac_os_x:-
-
cpe:2.3:o:vmware:esxi:7.0