CVE-2020-3997

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-10-23 · updated 2026-06-17
Weakness: CWE-79

Description

VMware Horizon Server (7.x prior to 7.10.3 or 7.13.0) contains a Cross Site Scripting (XSS) vulnerability. Successful exploitation of this issue may allow an attacker to inject malicious script which will be executed.

Affected products

VMware Horizon Agent for Linux: from 7.0 before 7.10.3; from 7.11.0 before 7.13.0 — fixed in 7.10.3, 7.13.0
VMware Horizon Server: from VMware Horizon Server (7.x prior through 7.10.3 or 7.13.0)

How to fix

Upgrade to a fixed version: VMware Horizon Agent for Linux 7.10.3, 7.13.0. Check the vendor advisory for mitigations.

References

https://www.vmware.com/security/advisories/VMSA-2020-0024.html
https://www.vmware.com/security/advisories/VMSA-2020-0024.html

Get alerted when CVE-2020-3997 or the next vulnerability affects your stack