VMSA-2021-0015

Moderate

Advisory ID: VMSA-2021-0015

CVSSv3 Range: 6.8

Issue Date: 2021-07-13

Updated On: 2021-07-13 (Initial Advisory)

CVE(s): CVE-2021-22000

Synopsis: VMware ThinApp update addresses a DLL hijacking vulnerability (CVE-2021-22000)

1. Impacted Products

VMware ThinApp

2. Introduction

A DLL hijacking vulnerability in VMware ThinApp was privately reported to VMware. Updates are available to remediate this vulnerability in affected VMware products.

3. VMware ThinApp update addresses a DLL hijacking vulnerability (CVE-2021-22000)

Description

VMware ThinApp contains a DLL hijacking vulnerability due to insecure loading of DLLs. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 6.8.

Known Attack Vectors

A malicious actor with non-administrative privileges may exploit this vulnerability to elevate privileges to administrator level on the Windows operating system having VMware ThinApp installed on it

Resolution

To remediate CVE-2021-22000, apply the patches listed in the 'Fixed Version' column of the 'Resolution Matrix' found below.

Workarounds

None.

Additional Documentation

None.

Notes

None.

Acknowledgements

VMware would like to thank Hou JingYi (@hjy79425575) of Qihoo 360 for reporting this issue to us.

Response Matrix

Product	Version	Running On	CVE Identifier	CVSSv3	Severity	Fixed Version	Workarounds	Additional Documentation
VMware ThinApp	5.x	Windows	CVE-2021-22000	6.8	moderate	5.2.10	None	None