CVE-2020-3977

MEDIUM

VMware Horizon DaaS 7.x-8.x < 8.0.1 - Authenticated Two-Factor Authentication Bypass

Title source: llm
STIX 2.1

Description

VMware Horizon DaaS (7.x and 8.x before 8.0.1 Update 1) contains a broken authentication vulnerability due to a flaw in the way it handled the first factor authentication. Successful exploitation of this issue may allow an attacker to bypass two-factor authentication process. In order to exploit this issue, an attacker must have a legitimate account on Horizon DaaS.

References (1)

Core 1
Core References
Patch, Vendor Advisory x_refsource_misc
https://www.vmware.com/security/advisories/VMSA-2020-0021.html

Scores

CVSS v3 6.5
EPSS 0.0012
EPSS Percentile 30.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-306
Status published
Products (2)
vmware/horizon_daas 7.0.0
vmware/horizon_daas 8.0.0 - 8.0.1
Published Sep 22, 2020
Tracked Since Feb 18, 2026