PT-2017-16211 · Vmware · Vsphere Web Client+1

Published 2017-11-17 · Updated 2018-10-30 · CVE-2017-4928

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions vSphere Web Client versions 6.0 prior to 6.0 U3c vSphere Web Client versions 5.5 prior to 5.5 U3f

Description The flash-based vSphere Web Client contains issues due to improper neutralization of URLs, specifically Server-Side Request Forgery (SSRF) and CRLF injection. An attacker may exploit these issues by sending a POST request with modified headers towards internal services, leading to information disclosure.

Recommendations For vSphere Web Client versions 6.0 prior to 6.0 U3c, update to version 6.0 U3c or later. For vSphere Web Client versions 5.5 prior to 5.5 U3f, update to version 5.5 U3f or later.

Fix

CSRF

SSRF

Weakness Enumeration

CWE-352

CWE-918

Related Identifiers

CVE-2017-4928

Affected Products

Vmware Vcenter

Vsphere Web Client

References · 5

• https://osv.dev/vulnerability/CVE-2017-4928 · Vendor Advisory
• https://vmware.com/security/advisories/VMSA-2017-0017.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-4928 · Security Note
• http://securitytracker.com/id/1039759 · Note
• http://securityfocus.com/bid/101785 · Note