CVE-2021-22000

VMware Thinapp version 5.x prior to 5.2.10 contain a DLL hijacking vulnerability due to insecure loading of DLLs. A malicious actor with non-administrative privileges may exploit this vulnerability to elevate privileges to administrator level on the Windows operating system having VMware ThinApp installed on it.

Affected

Vmware Thinapp

CVSS v3.1 NVD

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

6.9 MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C

EPSS

0.56% chance of exploitation in the next 30 days, 46th percentile

Published

2021-07-13

Updated

2024-08-03

Proof-of-concept exploits (1)

• http://packetstormsecurity.com/files/163521/VMware-ThinApp-DLL-Hijacking.html

Security advisories

• https://www.vmware.com/security/advisories/VMSA-2021-0015.html
• http://seclists.org/fulldisclosure/2021/Jul/35

References

• CVE Record
• NVD entry