CVE-2023-34037

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

VMware Horizon Server contains a HTTP request smuggling vulnerability. A malicious actor with network access may be able to perform HTTP smuggle requests.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-444

Affected software

Vendor	Product	Versions
n/a	VMware Horizon Server	Horizon Server 2306, Horizon Server 2303, Horizon Server 2212, Horizon Server 2209, Horizon Server 2206, Horizon Server 2111.x, Horizon Server 2106, Horizon Server 2103, Horizon Server 2012, Horizon Server 2006

References

https://www.vmware.com/security/advisories/VMSA-2023-0017.htmlVendor Advisory
https://www.vmware.com/security/advisories/VMSA-2023-0017.htmlVendor Advisory

Timeline

Published: Aug 4, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-340385.3VMware Horizon Server contains an information disclosure vulnerability. A malicious actor with network access may be able to access informat CVE-2023-340399.8Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. A malicio CVE-2023-34044.9The ProfileGrid plugin for WordPress is vulnerable to unauthorized decryption of private information in versions up to, and including, 5.5.0 CVE-2023-340407.8In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if CVE-2023-340415.3Cloud foundry routing release versions prior to 0.278.0 are vulnerable to abuse of HTTP Hop-by-Hop Headers. An unauthenticated attacker can CVE-2023-340425.5The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be wri CVE-2023-340436.7VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with administrative access to the local system CVE-2023-340446.0VMware Workstation( 17.x prior to 17.5) and Fusion(13.x prior to 13.5) contain an out-of-bounds read vulnerability that exists in the funct CVE-2023-340457.8VMware Fusion(13.x prior to 13.5) contains a local privilege escalation vulnerability that occurs during installation for the first time (t CVE-2023-340467.0VMware Fusion(13.x prior to 13.5) contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during installation for the first CVE-2023-340474.3A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, includ CVE-2023-340489.8vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network ac