VULNERABILITY INTELLIGENCE

CVE-2017-4897

CVSS score5.5 MEDIUM
EPSS probability1.15%
CISA KEVNot currently listed
Published2017-05-31
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Description

VMware Horizon DaaS before 7.0.0 contains a vulnerability that exists due to insufficient validation of data. An attacker may exploit this issue by tricking DaaS client users into connecting to a malicious server and sharing all their drives and devices. Successful exploitation of this vulnerability requires a victim to download a specially crafted RDP file through DaaS client by clicking on a malicious link.

Weakness classification

  • CWE-20: Improper Input Validation

Primary references