CVE-2023-34038: 
VMware Horizon Client vulnerability analysis and mitigation

VMware Horizon Server contains an information disclosure vulnerability identified as CVE-2023-34038. The vulnerability was discovered and reported to VMware, with the CVE being created on May 25, 2023, and publicly disclosed on August 4, 2023. This vulnerability affects multiple versions of VMware Horizon Server including 2303, 2212, 2209, 2206, 2111.x, 2106, 2103, 2012, and 2006 versions (VMware Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges or user interaction, and can result in low-level information disclosure (NVD).

When exploited, this vulnerability allows a malicious actor with network access to obtain information relating to the internal network configuration of the affected system (CVE).

The vulnerability can be exploited remotely by an attacker with network access to the affected system. No authentication is required to exploit this vulnerability, making it particularly concerning for internet-facing systems (Rapid7).

VMware has released patches to address this vulnerability. Users are advised to upgrade to the following fixed versions: 2306, 2212.1, 2209.1, or 2111.2 (VMware Advisory).