PT-2015-3313 · Vmware · Vmware Vcenter Server+1

Andrey Evlanin + 4 · Published 2015-10-23 · Updated 2018-10-30 · CVE-2016-7459

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions VMware vCenter Server versions 5.5 before U3e and 6.0 before U2a

Description The issue is related to an XML External Entity (XXE) problem, where there is an incorrect restriction of XML links to external objects. This can be exploited by a remote attacker to gain access to confidential information by sending a specially crafted XML request to the server. The exploitation is possible through the Log Browser, Distributed Switch setup, or Content Library XML document.

Recommendations For versions 5.5 before U3e, update to U3e or later to resolve the issue. For versions 6.0 before U2a, update to U2a or later to resolve the issue. As a temporary workaround, consider restricting access to the Log Browser, Distributed Switch setup, and Content Library XML documents to minimize the risk of exploitation.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2017-02206

CVE-2016-7459

Affected Products

Vmware Vcenter

Vmware Vcenter Server

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2016-7459 · Security Note
• http://vmware.com/security/advisories/VMSA-2016-0022.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-7459 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02206 · Security Note
• http://securitytracker.com/id/1037329 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7459%20http://vmware.com/security/advisories/VMSA-2016-0022.html%20http://securityfocus.com/bid/94486 · Note
• http://securityfocus.com/bid/94486 · Note
• http://securitylab.ru/lab/PT-2016-31 · Note