7.5

CVE-2017-4928

The flash-based vSphere Web Client (6.0 prior to 6.0 U3c and 5.5 prior to 5.5 U3f) i.e. not the new HTML5-based vSphere Client, contains SSRF and CRLF injection issues due to improper neutralization of URLs. An attacker may exploit these issues by sending a POST request with modified headers towards internal services leading to information disclosure.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
VMware ≫ vCenter Server Version 5.5
VMware ≫ vCenter Server Version 5.5 Update 1
VMware ≫ vCenter Server Version 5.5 Update 1a
VMware ≫ vCenter Server Version 5.5 Update 1b
VMware ≫ vCenter Server Version 5.5 Update 1c
VMware ≫ vCenter Server Version 5.5 Update 2
VMware ≫ vCenter Server Version 5.5 Update 2b
VMware ≫ vCenter Server Version 5.5 Update 2d
VMware ≫ vCenter Server Version 5.5 Update 2e
VMware ≫ vCenter Server Version 5.5 Update 3
VMware ≫ vCenter Server Version 5.5 Update 3a
VMware ≫ vCenter Server Version 5.5 Update 3b
VMware ≫ vCenter Server Version 5.5 Update 3d
VMware ≫ vCenter Server Version 5.5 Update 3e
VMware ≫ vCenter Server Version 5.5 Update b
VMware ≫ vCenter Server Version 5.5 Update c
VMware ≫ vCenter Server Version 6.0
VMware ≫ vCenter Server Version 6.0 Update 1
VMware ≫ vCenter Server Version 6.0 Update 1b
VMware ≫ vCenter Server Version 6.0 Update 2
VMware ≫ vCenter Server Version 6.0 Update 2a
VMware ≫ vCenter Server Version 6.0 Update 2m
VMware ≫ vCenter Server Version 6.0 Update 3
VMware ≫ vCenter Server Version 6.0 Update 3a
VMware ≫ vCenter Server Version 6.0 Update 3b
VMware ≫ vCenter Server Version 6.0 Update a
VMware ≫ vCenter Server Version 6.0 Update b
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.24% 0.652
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

CWE-918 Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

http://www.securitytracker.com/id/1039759
Third Party Advisory
VDB Entry
https://www.vmware.com/security/advisories/VMSA-2017-0017.html
Patch
Vendor Advisory
http://www.securityfocus.com/bid/101785
Third Party Advisory
VDB Entry