Vulnerability Details CVE-2021-22000
VMware Thinapp version 5.x prior to 5.2.10 contain a DLL hijacking vulnerability due to insecure loading of DLLs. A malicious actor with non-administrative privileges may exploit this vulnerability to elevate privileges to administrator level on the Windows operating system having VMware ThinApp installed on it.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 51.2%
CVSS Severity
CVSS v3 Score 7.8
CVSS v2 Score 6.9
References
- http://packetstormsecurity.com/files/163521/VMware-ThinApp-DLL-Hijacking.html
- http://seclists.org/fulldisclosure/2021/Jul/35
- https://www.vmware.com/security/advisories/VMSA-2021-0015.html
- http://packetstormsecurity.com/files/163521/VMware-ThinApp-DLL-Hijacking.html
- http://seclists.org/fulldisclosure/2021/Jul/35
- https://www.vmware.com/security/advisories/VMSA-2021-0015.html
Products affected by CVE-2021-22000
-
cpe:2.3:a:vmware:thinapp:5.2
-
cpe:2.3:a:vmware:thinapp:5.2.1
-
cpe:2.3:a:vmware:thinapp:5.2.2
-
cpe:2.3:a:vmware:thinapp:5.2.3
-
cpe:2.3:a:vmware:thinapp:5.2.4
-
cpe:2.3:a:vmware:thinapp:5.2.5
-
cpe:2.3:a:vmware:thinapp:5.2.6
-
cpe:2.3:a:vmware:thinapp:5.2.7
-
cpe:2.3:a:vmware:thinapp:5.2.8
-
cpe:2.3:a:vmware:thinapp:5.2.9