CVE-2020-3943

published 2020-02-19

CVE-2020-3943: vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) uses a JMX RMI service which is not securely configured. An…

Priority P2 63 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) uses a JMX RMI service which is not securely configured. An unauthenticated remote attacker who has network access to vRealize Operations, with the Horizon Adapter running, may be able to execute arbitrary code in vRealize Operations.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
vmware	vrealize_operations	>= 6.6.0 < 6.6.1	6.6.1
vmware	vrealize_operations	>= 6.7.0 < 6.7.1	6.7.1
vmware	vrealize_operations_for_horizon_adapter	—	—
vmware	vrealize_operations_for_horizon_adapter	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → Monitor for exploitation attempts targeting the JMX RMI service on vRealize Operations for Horizon Adapter versions 6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1 ↗

• · The JMX RMI service in vRealize Operations for Horizon Adapter is not securely configured by default, enabling unauthenticated remote access; this is the root misconfiguration enabling CVE-2020-3943 exploitation ↗
• · Exploitation requires network access to vRealize Operations with the Horizon Adapter actively running; disabling or isolating the adapter reduces attack surface ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20