CVE-2021-22000

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-07-13 · updated 2026-06-17
Weakness: CWE-427

Description

VMware Thinapp version 5.x prior to 5.2.10 contain a DLL hijacking vulnerability due to insecure loading of DLLs. A malicious actor with non-administrative privileges may exploit this vulnerability to elevate privileges to administrator level on the Windows operating system having VMware ThinApp installed on it.

Affected products

Vmware Thinapp: from 5.2 before 5.2.10 — fixed in 5.2.10
Vmware Thinapp: from VMware Thinapp 5.x prior through 5.2.10

How to fix

Upgrade to a fixed version: Vmware Thinapp 5.2.10. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/163521/VMware-ThinApp-DLL-Hijacking.html
http://seclists.org/fulldisclosure/2021/Jul/35
https://www.vmware.com/security/advisories/VMSA-2021-0015.html
http://packetstormsecurity.com/files/163521/VMware-ThinApp-DLL-Hijacking.html
http://seclists.org/fulldisclosure/2021/Jul/35
https://www.vmware.com/security/advisories/VMSA-2021-0015.html

Get alerted when CVE-2021-22000 or the next vulnerability affects your stack