CVE-2024-11467
Published: 04 February 2025
Description
Omnissa Horizon Client for macOS contains a Local privilege escalation (LPE) Vulnerability due to a logic flaw. Successful exploitation of this issue may allow attackers with user privileges to escalate their privileges to root on the system where the Horizon Client for macOS is installed.
Security Summary
CVE-2024-11467 is a local privilege escalation (LPE) vulnerability stemming from a logic flaw in the Omnissa Horizon Client for macOS. This issue affects systems where the Horizon Client is installed, enabling attackers to elevate privileges. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-269 (Improper Privilege Management).
Local users with standard privileges on the affected macOS system can exploit this vulnerability without requiring additional user interaction. Successful exploitation grants root-level access, potentially allowing full control over the system, including high-impact compromise of confidentiality, integrity, and availability.
Omnissa has published security advisory OMSA-2024-0002, available at https://static.omnissa.com/sites/default/files/OMSA-2024-0002.pdf, along with additional details on their security response page at https://www.omnissa.com/omnissa-security-response/. These resources outline mitigation and patching guidance for addressing the vulnerability.
Details
- CWE(s)