Read the docs
TI-2019-03919 Aliases CVE-2019-5513GHSA-fw8h-225v-qpf3

VMware Horizon Connection Server (7.x before 7.8, 7.5.x before 7.5.2, 6.x before 6.2.8)…

Priority LOW 27Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

VMware Horizon Connection Server (7.x before 7.8, 7.5.x before 7.5.2, 6.x before 6.2.8) contains an information disclosure vulnerability. Successful exploitation of this issue may allow disclosure of internal domain names, the Connection Server’s internal name, or the gateway’s internal IP address.

Why it matters now

EPSS 0.01266 69th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—VMware Horizon Connection ServerVMware Horizon Connection Server 7.x before 7.8, 7.5.x before 7.5.2, 6.x before 6.2.8—No fix listedCNA
  • VMware Horizon Connection Server Vendor— Affected VMware Horizon Connection Server 7.x before 7.8, 7.5.x before 7.5.2, 6.x before 6.2.8 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:vmware:horizon:*:*:*:*:*:*:*:*6.0.0 to before 6.2.8; 7.0 to before 7.8; 7.5.0 to before 7.5.2VulnerableVMware
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:vmware:horizon:*:*:*:*:*:*:*:* Versions 6.0.0 to before 6.2.8; 7.0 to before 7.8; 7.5.0 to before 7.5.2 Vulnerable ·VMware
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-5513
  2. 2026-10-03 Alias added: GHSA-fw8h-225v-qpf3

References

Patch 1

  • TI-2019-03933 Use after free in ESXi, Workstation, Fusion, VMRC and Horizon Client CVSS 3.1HIGH 8.8
  • TI-2022-07141 VMware Horizon Agent for Linux (prior to 22.x) contains a local privilege escalation that… CVSS 3.1HIGH 7.8
  • TI-2022-07139 Link following in VMware Horizon Agent for Linux CVSS 3.1HIGH 7.8
  • TI-2022-07117 VMware Workstation (16.x prior to 16.2.2) and Horizon Client for Windows (5.x prior to… CVSS 3.1MEDIUM 6.5
  • TI-2020-03493 Cross-site scripting in VMware Horizon Server CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences