PT-2017-16202 · Vmware · Vix Api+2

Published 2017-07-28 · Updated 2019-10-03 · CVE-2017-4919

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware vCenter Server versions 5.5 through 6.5

Description The issue allows vSphere users with certain limited vSphere privileges to access Guest Operating Systems without authentication using the VIX API.

Recommendations For versions 5.5 through 6.5, consider restricting access to the VIX API until a patch is available. As a temporary workaround, review and limit vSphere privileges to minimize the risk of exploitation.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2017-4919

Affected Products

Vix Api

Vmware Vcenter Server

Vsphere

References · 5

• https://osv.dev/vulnerability/CVE-2017-4919 · Vendor Advisory
• http://vmware.com/security/advisories/VMSA-2017-0012.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-4919 · Security Note
• http://securityfocus.com/bid/100102 · Note
• http://securitytracker.com/id/1039004 · Note