1. Impacted Products
- VMware ThinApp
A DLL hijacking vulnerability in VMware ThinApp was privately reported to VMware. Updates are available to remediate this vulnerability in affected VMware products.
3. VMware ThinApp update addresses a DLL hijacking vulnerability (CVE-2021-22000)
VMware ThinApp contains a DLL hijacking vulnerability due to insecure loading of DLLs. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 6.8.
Known Attack Vectors
A malicious actor with non-administrative privileges may exploit this vulnerability to elevate privileges to administrator level on the Windows operating system having VMware ThinApp installed on it
To remediate CVE-2021-22000, apply the patches listed in the 'Fixed Version' column of the 'Resolution Matrix' found below.
VMware would like to thank Hou JingYi (@hjy79425575) of Qihoo 360 for reporting this issue to us.
|Product||Version||Running On||CVE Identifier||CVSSv3||Severity||Fixed Version||Workarounds||Additional Documentation|
Fixed Version(s) and Release Notes:
Mitre CVE Dictionary Links:
FIRST CVSSv3 Calculator:
5. Change Log
Initial security advisory.
E-mail list for product security notifications and announcements:
This Security Advisory is posted to the following lists:
PGP key at:
VMware Security Advisories
VMware Security Response Policy
VMware Lifecycle Support Phases
VMware Security & Compliance Blog
Copyright 2021 VMware Inc. All rights reserved.