5.8

CVE-2016-7458

VMware vSphere Client 5.5 before U3e and 6.0 before U2a allows remote vCenter Server and ESXi instances to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Data is provided by the National Vulnerability Database (NVD)
VMware ≫ Vsphere Client Version5.5
VMware ≫ Vsphere Client Version5.5 Updateu1
VMware ≫ Vsphere Client Version5.5 Updateu2
VMware ≫ Vsphere Client Version5.5 Updateu3a
VMware ≫ Vsphere Client Version5.5 Updateu3b
VMware ≫ Vsphere Client Version6.0
VMware ≫ Vsphere Client Version6.0 Update2
VMware ≫ Vsphere Client Version6.0 Update2m
VMware ≫ Vsphere Client Version6.0 Updatea
VMware ≫ Vsphere Client Version6.0 Updateb
VMware ≫ Vsphere Client Version6.0 Updateu1
VMware ≫ Vsphere Client Version6.0 Updateu1b
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.45% 0.607
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5.8 3.9 1.4
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-611 Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

http://www.securityfocus.com/bid/94483
Third Party Advisory
VDB Entry