PT-2015-3309 · Vmware · Vmware Esxi+2
Ammarit Thongthua
+9
·
Published
2015-10-23
·
Updated
2018-10-09
·
CVE-2016-5331
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
VMware vCenter Server version 6.0 before U2
VMware ESXi version 6.0
Description
The issue is related to a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks. This is due to the failure to properly handle CRLF sequences, allowing user-supplied data to be added to HTTP response headers without proper processing. As a result, an attacker can control HTTP response headers and bodies, potentially leading to cross-site scripting attacks and attacks on intermediate proxy servers.
Recommendations
For VMware vCenter Server version 6.0 before U2, update to version U2 or later to resolve the issue.
For VMware ESXi version 6.0, update to a version that includes the fix for this issue, as no specific version is mentioned as being unaffected.
At the moment, there is no information about a newer version that contains a fix for VMware ESXi version 6.0.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Vmware Vcenter
Vmware Esxi
Vmware Vcenter Server