CVE-2017-4897

https://notcve.org/view.php?id=CVE-2017-4897

VMware Horizon DaaS before 7.0.0 contains a vulnerability that exists due to insufficient validation of data. An attacker may exploit this issue by tricking DaaS client users into connecting to a malicious server and sharing all their drives and devices. Successful exploitation of this vulnerability requires a victim to download a specially crafted RDP file through DaaS client by clicking on a malicious link. Horizon DaaS anterior a versión 7.0.0 de VMware, contiene una vulnerabilidad que se presenta debido a la comprobación insuficiente de datos. Un atacante puede explotar este problema mediante el engaño a los usuarios del cliente DaaS para que se conecten a un servidor malicioso y compartan todas sus unidades y dispositivos. • http://www.securityfocus.com/bid/96559 http://www.securitytracker.com/id/1037951 http://www.vmware.com/security/advisories/VMSA-2017-0002.html • CWE-20: Improper Input Validation •