PT-2017-16202 · Vmware · Vix Api+2

Publicado 2017-07-28 · Atualizado 2019-10-03 · CVE-2017-4919

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Crítica

Vetor base

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware vCenter Server versions 5.5 through 6.5

Description The issue allows vSphere users with certain limited vSphere privileges to access Guest Operating Systems without authentication using the VIX API.

Recommendations For versions 5.5 through 6.5, consider restricting access to the VIX API until a patch is available. As a temporary workaround, review and limit vSphere privileges to minimize the risk of exploitation.

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2017-4919

Produtos afetados

Vix Api

Vmware Vcenter Server

Vsphere

Referências · 5

• http://securityfocus.com/bid/100102 · Nota
• http://securitytracker.com/id/1039004 · Nota
• https://osv.dev/vulnerability/CVE-2017-4919 · Aviso do Fabricante
• http://vmware.com/security/advisories/VMSA-2017-0012.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-4919 · Nota de Segurança