{"api_version":"1","generated_at":"2026-05-11T00:06:49+00:00","cve":"CVE-2018-6971","urls":{"html":"https://cve.report/CVE-2018-6971","api":"https://cve.report/api/cve/CVE-2018-6971.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2018-6971","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-6971"},"summary":{"title":"CVE-2018-6971","description":"VMware Horizon View Agents (7.x.x before 7.5.1) contain a local information disclosure vulnerability due to insecure logging of credentials in the vmmsi.log file when an account other than the currently logged on user is specified during installation (including silent installations). Successful exploitation of this issue may allow low privileged users access to the credentials specified during the Horizon View Agent installation.","state":"PUBLIC","assigner":"security@vmware.com","published_at":"2018-07-25 13:29:00","updated_at":"2019-10-03 00:03:00"},"problem_types":["CWE-532"],"metrics":[],"references":[{"url":"https://www.vmware.com/security/advisories/VMSA-2018-0018.html","name":"https://www.vmware.com/security/advisories/VMSA-2018-0018.html","refsource":"CONFIRM","tags":["Vendor Advisory"],"title":"VMSA-2018-0018","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1041358","name":"1041358","refsource":"SECTRACK","tags":["Third Party Advisory","VDB Entry"],"title":"VMware Horizon View Agent Logging Error Lets Local Users View Passwords - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1041357","name":"1041357","refsource":"SECTRACK","tags":["Third Party Advisory","VDB Entry"],"title":"VMware ESXi Null Pointer Dereference in RPC Handler Lets Local Users on a Guest System Cause Denial of Service Conditions on Their Guest System - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/104883","name":"104883","refsource":"BID","tags":["Third Party Advisory","VDB Entry"],"title":"VMware Horizon View Agent CVE-2018-6971 Local Information Disclosure Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6971","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6971","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2018","cve_id":"6971","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"vmware","cpe5":"horizon_view_agents","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"6971","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"vmware","cpe5":"horizon_view_agents","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security@vmware.com","DATE_PUBLIC":"2018-07-19T00:00:00","ID":"CVE-2018-6971","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Horizon View Agent","version":{"version_data":[{"version_value":"7.x.x before 7.5.1"}]}}]},"vendor_name":"VMware"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"VMware Horizon View Agents (7.x.x before 7.5.1) contain a local information disclosure vulnerability due to insecure logging of credentials in the vmmsi.log file when an account other than the currently logged on user is specified during installation (including silent installations). Successful exploitation of this issue may allow low privileged users access to the credentials specified during the Horizon View Agent installation."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Local information disclosure vulnerability"}]}]},"references":{"reference_data":[{"name":"1041357","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1041357"},{"name":"104883","refsource":"BID","url":"http://www.securityfocus.com/bid/104883"},{"name":"1041358","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1041358"},{"name":"https://www.vmware.com/security/advisories/VMSA-2018-0018.html","refsource":"CONFIRM","url":"https://www.vmware.com/security/advisories/VMSA-2018-0018.html"}]}},"nvd":{"publishedDate":"2018-07-25 13:29:00","lastModifiedDate":"2019-10-03 00:03:00","problem_types":["CWE-532"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:P/I:N/A:N","accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":2.1},"severity":"LOW","exploitabilityScore":3.9,"impactScore":2.9,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:vmware:horizon_view_agents:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.5.1","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2018","CveId":"6971","Ordinal":"123205","Title":"CVE-2018-6971","CVE":"CVE-2018-6971","Year":"2018"},"notes":[{"CveYear":"2018","CveId":"6971","Ordinal":"1","NoteData":"VMware Horizon View Agents (7.x.x before 7.5.1) contain a local information disclosure vulnerability due to insecure logging of credentials in the vmmsi.log file when an account other than the currently logged on user is specified during installation (including silent installations). Successful exploitation of this issue may allow low privileged users access to the credentials specified during the Horizon View Agent installation.","Type":"Description","Title":null},{"CveYear":"2018","CveId":"6971","Ordinal":"2","NoteData":"2018-07-25","Type":"Other","Title":"Published"},{"CveYear":"2018","CveId":"6971","Ordinal":"3","NoteData":"2018-07-27","Type":"Other","Title":"Modified"}]}}}