CVE-2019-5514 Missing authorization in VMware Fusion
An attacker can execute commands on guest machines via unauthenticated web socket APIs in VMware Fusion by tricking the host user into running JavaScript.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-5514?
CVE-2019-5514 is a high-severity missing authorization vulnerability in Vmware Fusion, published on 1 Apr 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
VMware VMware Fusion (11.x before 11.0.3) contains a security vulnerability due to certain unauthenticated APIs accessible through a web socket. An attacker may exploit this issue by tricking the host user to execute a JavaScript to perform unauthorized functions on the guest machine where VMware Tools is installed. This may further be exploited to execute commands on the guest machines.
Weakness: CWE-306
Which versions are affected by CVE-2019-5514?
It affects 1 product.
Products include Vmware Fusion.
How do I fix CVE-2019-5514?
No fix has been published for CVE-2019-5514 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2019-5514 being exploited?
There is no known exploitation of CVE-2019-5514 in the wild and no public exploit code.
Other vulnerabilities in Vmware Fusion
Sources
Also known as GHSA-6vc3-crc6-4w78.