PT-2016-6370 · Vmware · Vrealize Automation+1

Published 2016-12-29 · Updated 2022-04-08 · CVE-2016-5334

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions VMware Identity Manager versions prior to 2.7.1 vRealize Automation versions prior to 7.2.0

Description The issue allows remote attackers to read sensitive files, specifically /SAAS/WEB-INF and /SAAS/META-INF files, via unspecified vectors.

Recommendations For VMware Identity Manager versions prior to 2.7.1, update to version 2.7.1 or later. For vRealize Automation versions prior to 7.2.0, update to version 7.2.0 or later.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2016-5334

Affected Products

Vmware Identity Manager

Vrealize Automation

References · 5

• https://osv.dev/vulnerability/CVE-2016-5334 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-5334 · Security Note
• http://vmware.com/security/advisories/VMSA-2016-0021.html · Vendor Advisory
• http://securityfocus.com/bid/94482 · Note
• http://securitytracker.com/id/1037326 · Note