« Volver al listado

CVE-2023-34037

Estado: ModificadaMedia (5.3)—

VMware Horizon Server contains a HTTP request smuggling vulnerability. A malicious actor with network access may be able to perform HTTP smuggle requests.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Vmware — Horizon Client

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-34037",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-34037",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-21T17:29:46.397099Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@vmware.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "VMware Horizon Server",
          "versions": [
            {
              "status": "affected",
              "version": "Horizon Server 2306, Horizon Server 2303, Horizon Server 2212, Horizon Server 2209, Horizon Server 2206, Horizon Server 2111.x, Horizon Server 2106, Horizon Server 2103, Horizon Server 2012, Horizon Server 2006"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-08-04T12:15:09.703",
  "references": [
    {
      "url": "https://www.vmware.com/security/advisories/VMSA-2023-0017.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "https://www.vmware.com/security/advisories/VMSA-2023-0017.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-444"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "VMware Horizon Server contains a HTTP request smuggling vulnerability. A malicious actor with network access may be able to perform HTTP smuggle requests.\n\n"
    },
    {
      "lang": "es",
      "value": "VMware Horizon Server contiene una vulnerabilidad de contrabando de solicitudes HTTP. Un actor malicioso con acceso a la red puede ser capaz de realizar peticiones HTTP de contrabando."
    }
  ],
  "lastModified": "2026-06-17T06:02:46.420",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:horizon_client:2006:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7ABDAB76-D9B4-4677-A489-AB8679C826A9"
            },
            {
              "criteria": "cpe:2.3:a:vmware:horizon_client:2012:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A67E7F43-E1B4-4C36-819F-758242C62692"
            },
            {
              "criteria": "cpe:2.3:a:vmware:horizon_client:2103:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4E58D474-F936-49F0-A94A-F58EC1ECB076"
            },
            {
              "criteria": "cpe:2.3:a:vmware:horizon_client:2106:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EBDBA771-953F-4994-8FAB-A0CFBF007C08"
            },
            {
              "criteria": "cpe:2.3:a:vmware:horizon_client:2111:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "57471903-7385-441C-A8C4-19BD02EDACD5"
            },
            {
              "criteria": "cpe:2.3:a:vmware:horizon_client:2111.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E3BAFD5F-6559-45DC-BC66-C9CEEBF4DD3F"
            },
            {
              "criteria": "cpe:2.3:a:vmware:horizon_client:2203:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0E2E38F7-9453-45C8-A8D7-48F16ED63C5A"
            },
            {
              "criteria": "cpe:2.3:a:vmware:horizon_client:2212:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C6C858A-FB4C-43CF-9924-670CE4699F51"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@vmware.com"
}