PT-2017-16211 · Vmware · Vsphere Web Client+1

Publicado 2017-11-17 · Atualizado 2018-10-30 · CVE-2017-4928

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions vSphere Web Client versions 6.0 prior to 6.0 U3c vSphere Web Client versions 5.5 prior to 5.5 U3f

Description The flash-based vSphere Web Client contains issues due to improper neutralization of URLs, specifically Server-Side Request Forgery (SSRF) and CRLF injection. An attacker may exploit these issues by sending a POST request with modified headers towards internal services, leading to information disclosure.

Recommendations For vSphere Web Client versions 6.0 prior to 6.0 U3c, update to version 6.0 U3c or later. For vSphere Web Client versions 5.5 prior to 5.5 U3f, update to version 5.5 U3f or later.

Correção

CSRF

SSRF

Enumeração de Fraquezas

CWE-352

CWE-918

Identificadores relacionados

CVE-2017-4928

Produtos afetados

Vmware Vcenter

Vsphere Web Client

Referências · 5

• http://securitytracker.com/id/1039759 · Nota
• https://osv.dev/vulnerability/CVE-2017-4928 · Aviso do Fabricante
• http://securityfocus.com/bid/101785 · Nota
• https://vmware.com/security/advisories/VMSA-2017-0017.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-4928 · Nota de Segurança