CVE-2023-34045

VMware Fusion(13.x prior to 13.5) contains a local privilege escalation vulnerability that occurs during installation for the first time (the user needs to drag or copy the application to a folder from the '.dmg' volume) or when installing an upgrade. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed or being installed for the first time.

CVSS v3 6.6 MEDIUM

6.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.3 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.vmware.com/security/advisories/VMSA-2023-0022.html	Vendor Advisory
https://www.vmware.com/security/advisories/VMSA-2023-0022.html	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*

History

07 Mar 2025, 19:15

Type	Values Removed	Values Added
CWE		CWE-269

21 Nov 2024, 08:06

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~7.8~~	v2 : unknown v3 : 6.6
References	~~() https://www.vmware.com/security/advisories/VMSA-2023-0022.html - Vendor Advisory~~	() https://www.vmware.com/security/advisories/VMSA-2023-0022.html - Vendor Advisory

28 Oct 2023, 03:34

Type	Values Removed	Values Added
References	~~(MISC) https://www.vmware.com/security/advisories/VMSA-2023-0022.html -~~	(MISC) https://www.vmware.com/security/advisories/VMSA-2023-0022.html - Vendor Advisory
CWE		NVD-CWE-noinfo
First Time		Apple mac Os X Vmware Vmware fusion Apple
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.8
CPE		cpe:2.3:o:apple:mac_os_x:-:::::::* cpe:2.3:a:vmware:fusion::::::::

20 Oct 2023, 11:27

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-10-20 10:15

Updated : 2025-03-07 19:15

NVD link : CVE-2023-34045

Mitre link : CVE-2023-34045

CVE.ORG link : CVE-2023-34045

JSON object : View

Products Affected

apple

mac_os_x

vmware

fusion

CWE

NVD-CWE-noinfo CWE-269

Improper Privilege Management

{"id": "CVE-2023-34045", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@vmware.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2023-10-20T10:15:12.787", "references": [{"url": "https://www.vmware.com/security/advisories/VMSA-2023-0022.html", "tags": ["Vendor Advisory"], "source": "security@vmware.com"}, {"url": "https://www.vmware.com/security/advisories/VMSA-2023-0022.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "VMware Fusion(13.x prior to 13.5)\u00a0contains a local privilege escalation vulnerability that occurs during \ninstallation for the first time (the user needs to drag or copy the \napplication to a folder from the '.dmg' volume) or when installing an \nupgrade.\u00a0A malicious actor with local non-administrative user privileges may \nexploit this vulnerability to escalate privileges to root on the system \nwhere Fusion is installed or being installed for the first time."}, {"lang": "es", "value": "VMware Fusion (13.x anterior a 13.5) contiene una vulnerabilidad de escalada de privilegios local que ocurre durante la instalaci\u00f3n por primera vez (el usuario necesita arrastrar o copiar la aplicaci\u00f3n a una carpeta desde el volumen '.dmg') o al instalar una actualizaci\u00f3n. Un actor malicioso con privilegios de usuario local no administrativo puede aprovechar esta vulnerabilidad para escalar privilegios a root en el System donde Fusion est\u00e1 instalado o donde se instala por primera vez."}], "lastModified": "2025-03-07T19:15:35.263", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F574C812-1E1F-4991-9442-74E799DACAD8", "versionEndExcluding": "13.5", "versionStartIncluding": "13.0.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4781BF1E-8A4E-4AFF-9540-23D523EE30DD"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security@vmware.com"}