CVE-2023-34038: VMware Horizon Server contains an information disclosure vulnerability

Routine

MEDIUM 5.3REMOTEDOWNGRADE

CVE-2023-34038 is a medium-severity flaw (CVSS 5.3) affecting horizon client. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

VMware Horizon Server contains an information disclosure vulnerability. A malicious actor with network access may be able to access information relating to the internal network configuration.

Why this priority

Remotely exploitable, no login, no user action

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	5.3 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	0.5% (top 58%)
CISA exploited list	No
Published	2023-08-04
Last modified	2026-06-17

Publisher (CNA): VMware · Vendor: vmware

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2023-08-04 12:15 UTCPublished CVE record published
2026-06-17 06:02 UTCUpdated Record last modified

vmware horizon client DOWNGRADE

Affected: 2006 · 2012 · 2103 · 2106 · 2111 · 2111.1 · 2203 · 2212

Fixed in: no fixed release known

Safe to downgrade to: a release before 2006

1. Check installed version

apt-cache policy horizon-client || rpm -q horizon-client || horizon-client --version

2. No fixed release: DOWNGRADE to a release before 2006 (Debian / Ubuntu)

apt-cache madison horizon-client sudo apt install horizon-client=<VERSION_BEFORE_2006> sudo apt-mark hold horizon-client

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list horizon-client sudo dnf downgrade horizon-client-<VERSION_BEFORE_2006> sudo dnf versionlock add horizon-client

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2023-34038?

horizon client: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2023-34038 being exploited?

CVE-2023-34038 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2023-34038 affect?

CVE-2023-34038 affects horizon client. Severity is medium (CVSS 5.3). VMware Horizon Server contains an information disclosure vulnerability. A malicious actor with network access may be able to access information relating to the internal network configuration.

How urgent is CVE-2023-34038?

Priority 34/100. Remotely exploitable, no login, no user action

Software pages

VMware vulnerabilities

Related CVEs

CVE-2023-34037 MEDIUM 5.3 DOWNGRADE VMware Horizon Server contains a HTTP request smuggling vulnerability
CVE-2021-21989 MEDIUM 6.5 UPGRADE UPGRADE VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-b
CVE-2021-21988 MEDIUM 6.5 UPGRADE UPGRADE VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-b
CVE-2021-21987 MEDIUM 6.5 UPGRADE UPGRADE VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-b
CVE-2020-3998 MEDIUM 6.5 UPGRADE VMware Horizon Client for Windows (5.x prior to 5.5.0) contains an information disclosure vulnerability

References

← Back to latest CVEs