« Volver al listado

CVE-2019-5514

Estado: ModificadaAlta (8.8)—

VMware VMware Fusion (en las versiones 11.x anteriores a la 11.0.3) contiene una vulnerabilidad de seguridad debido a determinadas API sin autenticar accesibles a través de un socket web. Un atacante podría explotar este fallo engañando al usuario host para que ejecute código JavaScript para realizar funciones no autorizadas en la máquina invitada donde las herramientas VMware están instaladas. Esto podría explotarse aún más para ejecutar comandos en las máquinas invitadas

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Vmware — Fusion

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-5514",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "VMware",
          "product": "VMware Fusion",
          "versions": [
            {
              "status": "affected",
              "version": "11.x before 11.0.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-04-01T21:30:43.860",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/152290/VMware-Security-Advisory-2019-0005.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/107637",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "https://www.vmware.com/security/advisories/VMSA-2019-0005.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "http://packetstormsecurity.com/files/152290/VMware-Security-Advisory-2019-0005.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/107637",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.vmware.com/security/advisories/VMSA-2019-0005.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "VMware VMware Fusion (11.x before 11.0.3) contains a security vulnerability due to certain unauthenticated APIs accessible through a web socket. An attacker may exploit this issue by tricking the host user to execute a JavaScript to perform unauthorized functions on the guest machine where VMware Tools is installed. This may further be exploited to execute commands on the guest machines."
    },
    {
      "lang": "es",
      "value": "VMware VMware Fusion (en las versiones 11.x anteriores a la 11.0.3) contiene una vulnerabilidad de seguridad debido a determinadas API sin autenticar accesibles a través de un socket web. Un atacante podría explotar este fallo engañando al usuario host para que ejecute código JavaScript para realizar funciones no autorizadas en la máquina invitada donde las herramientas VMware están instaladas. Esto podría explotarse aún más para ejecutar comandos en las máquinas invitadas"
    }
  ],
  "lastModified": "2026-06-17T02:37:49.587",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D1D88E61-CE5C-467A-A720-F4DCFC248134",
              "versionEndExcluding": "11.0.3",
              "versionStartIncluding": "11.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@vmware.com"
}