PT-2015-3313 · Vmware · Vmware Vcenter Server+1

Andrey Evlanin + 4 · Publicado 2015-10-23 · Atualizado 2018-10-30 · CVE-2016-7459

Positive Technologies (AI Summary)

CVSS v3.1

7.7

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions VMware vCenter Server versions 5.5 before U3e and 6.0 before U2a

Description The issue is related to an XML External Entity (XXE) problem, where there is an incorrect restriction of XML links to external objects. This can be exploited by a remote attacker to gain access to confidential information by sending a specially crafted XML request to the server. The exploitation is possible through the Log Browser, Distributed Switch setup, or Content Library XML document.

Recommendations For versions 5.5 before U3e, update to U3e or later to resolve the issue. For versions 6.0 before U2a, update to U2a or later to resolve the issue. As a temporary workaround, consider restricting access to the Log Browser, Distributed Switch setup, and Content Library XML documents to minimize the risk of exploitation.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

BDU:2017-02206

CVE-2016-7459

Produtos afetados

Vmware Vcenter

Vmware Vcenter Server

Referências · 8

• http://securitytracker.com/id/1037329 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7459%20http://vmware.com/security/advisories/VMSA-2016-0022.html%20http://securityfocus.com/bid/94486 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-7459 · Nota de Segurança
• http://vmware.com/security/advisories/VMSA-2016-0022.html · Aviso do Fabricante
• http://securityfocus.com/bid/94486 · Nota
• http://securitylab.ru/lab/PT-2016-31 · Nota
• https://osv.dev/vulnerability/CVE-2016-7459 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2017-02206 · Nota de Segurança