fkie_nvd - fkie_cve-2023-34037

FKIE_CVE-2023-34037

Vulnerability from fkie_nvd - Published: 2023-08-04 12:15 - Updated: 2024-11-21 08:06

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Summary

VMware Horizon Server contains a HTTP request smuggling vulnerability. A malicious actor with network access may be able to perform HTTP smuggle requests.

References

	URL	Tags
	security@vmware.com	https://www.vmware.com/security/advisories/VMSA-2023-0017.html	Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://www.vmware.com/security/advisories/VMSA-2023-0017.html	Vendor Advisory

Impacted products

Vendor	Product	Version
vmware	horizon_client	2006
vmware	horizon_client	2012
vmware	horizon_client	2103
vmware	horizon_client	2106
vmware	horizon_client	2111
vmware	horizon_client	2111.1
vmware	horizon_client	2203
vmware	horizon_client	2212

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:horizon_client:2006:*:*:*:*:*:*:*",
              "matchCriteriaId": "7ABDAB76-D9B4-4677-A489-AB8679C826A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:horizon_client:2012:*:*:*:*:*:*:*",
              "matchCriteriaId": "A67E7F43-E1B4-4C36-819F-758242C62692",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:horizon_client:2103:*:*:*:*:*:*:*",
              "matchCriteriaId": "4E58D474-F936-49F0-A94A-F58EC1ECB076",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:horizon_client:2106:*:*:*:*:*:*:*",
              "matchCriteriaId": "EBDBA771-953F-4994-8FAB-A0CFBF007C08",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:horizon_client:2111:*:*:*:*:*:*:*",
              "matchCriteriaId": "57471903-7385-441C-A8C4-19BD02EDACD5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:horizon_client:2111.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E3BAFD5F-6559-45DC-BC66-C9CEEBF4DD3F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:horizon_client:2203:*:*:*:*:*:*:*",
              "matchCriteriaId": "0E2E38F7-9453-45C8-A8D7-48F16ED63C5A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:horizon_client:2212:*:*:*:*:*:*:*",
              "matchCriteriaId": "8C6C858A-FB4C-43CF-9924-670CE4699F51",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "VMware Horizon Server contains a HTTP request smuggling vulnerability. A malicious actor with network access may be able to perform HTTP smuggle requests.\n\n"
    },
    {
      "lang": "es",
      "value": "VMware Horizon Server contiene una vulnerabilidad de contrabando de solicitudes HTTP. Un actor malicioso con acceso a la red puede ser capaz de realizar peticiones HTTP de contrabando."
    }
  ],
  "id": "CVE-2023-34037",
  "lastModified": "2024-11-21T08:06:26.927",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security@vmware.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-08-04T12:15:09.703",
  "references": [
    {
      "source": "security@vmware.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.vmware.com/security/advisories/VMSA-2023-0017.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.vmware.com/security/advisories/VMSA-2023-0017.html"
    }
  ],
  "sourceIdentifier": "security@vmware.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-444"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2023-34037 (GCVE-0-2023-34037)

Vulnerability from cvelistv5 – Published: 2023-08-04 11:18 – Updated: 2024-10-21 17:30

Summary

VMware Horizon Server contains a HTTP request smuggling vulnerability. A malicious actor with network access may be able to perform HTTP smuggle requests.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE

Request smuggling vulnerability

Assigner

vmware

References

URL

Tags

https://www.vmware.com/security/advisories/VMSA-2…

Impacted products

	Vendor	Product	Version
	n/a	VMware Horizon Server	Affected: Horizon Server 2306, Horizon Server 2303, Horizon Server 2212, Horizon Server 2209, Horizon Server 2206, Horizon Server 2111.x, Horizon Server 2106, Horizon Server 2103, Horizon Server 2012, Horizon Server 2006

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T15:54:14.130Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.vmware.com/security/advisories/VMSA-2023-0017.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-34037",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T17:29:46.397099Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T17:30:05.673Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "VMware Horizon Server",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Horizon Server 2306, Horizon Server 2303, Horizon Server 2212, Horizon Server 2209, Horizon Server 2206, Horizon Server 2111.x, Horizon Server 2106, Horizon Server 2103, Horizon Server 2012, Horizon Server 2006"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "VMware Horizon Server contains a HTTP request smuggling vulnerability. A malicious actor with network access may be able to perform HTTP smuggle requests.\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "VMware Horizon Server contains a HTTP request smuggling vulnerability. A malicious actor with network access may be able to perform HTTP smuggle requests.\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Request smuggling vulnerability",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-08-04T11:18:19.611Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://www.vmware.com/security/advisories/VMSA-2023-0017.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2023-34037",
    "datePublished": "2023-08-04T11:18:19.611Z",
    "dateReserved": "2023-05-25T17:21:56.200Z",
    "dateUpdated": "2024-10-21T17:30:05.673Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

FKIE_CVE-2023-34037

CVE-2023-34037 (GCVE-0-2023-34037)

Tags

Sightings

Nomenclature