PT-2015-3312 · Vmware · Vmware Vsphere Client+3

Andrey Evlanin + 4 · Published 2015-10-23 · Updated 2017-07-28 · CVE-2016-7458

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions VMware vSphere Client versions 5.5 before U3e VMware vSphere Client versions 6.0 before U2a

Description The issue is related to an XML External Entity (XXE) problem, where an XML document containing an external entity declaration in conjunction with an entity reference can be used to read arbitrary files. This is due to incorrect restriction of XML links to external objects. Exploitation of the issue may allow a remote attacker to access confidential information by convincing a user to connect to a malicious vCenter or ESXi server.

Recommendations For versions 5.5 before U3e, update to U3e or later to resolve the issue. For versions 6.0 before U2a, update to U2a or later to resolve the issue. As a temporary workaround, consider restricting access to the vCenter and ESXi servers to minimize the risk of exploitation.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2017-02205

CVE-2016-7458

Affected Products

Esxi

Vmware Vcenter

Vmware Vsphere Client

Vcenter

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2016-7458 · Security Note
• https://osv.dev/vulnerability/CVE-2016-7458 · Vendor Advisory
• http://vmware.com/security/advisories/VMSA-2016-0022.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02205 · Security Note
• http://securitylab.ru/lab/PT-2016-30 · Note
• http://securityfocus.com/bid/94483 · Note
• http://securitytracker.com/id/1037328 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7458%20http://vmware.com/security/advisories/VMSA-2016-0022.html%20http://securityfocus.com/bid/94483 · Note