CVE-2023-34037: 
VMware Horizon Client vulnerability analysis and mitigation

VMware Horizon Server was found to contain a HTTP request smuggling vulnerability identified as CVE-2023-34037. The vulnerability was disclosed on August 4, 2023, affecting multiple versions of VMware Horizon Server including versions 2303, 2212, 2209, 2206, 2111.x, 2106, 2103, 2012, and 2006. This security flaw allows a malicious actor with network access to perform HTTP smuggle requests (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The vulnerability is classified under CWE-444 (Inconsistent Interpretation of HTTP Requests) and requires network access for exploitation (NVD).

When exploited, this vulnerability allows attackers with network access to perform HTTP smuggle requests, potentially leading to unauthorized actions or access within the affected systems (Rapid7).

The vulnerability requires network access for exploitation, with no authentication needed (as indicated by the CVSS metrics PR:N/UI:N). No specific details about exploitation in the wild have been publicly disclosed (NVD).

VMware has released patches to address this vulnerability. Users are advised to upgrade to the following fixed versions: 2306, 2212.1, 2209.1, or 2111.2 (ASEC).