Lucene search

[email protected]CVE-2016-2076

HistoryApr 15, 2016 - 2:59 p.m.

CVE-2016-2076

2016-04-1514:59:10

CWE-287

[email protected]

web.nvd.nist.gov

cve-2016-2076

vmware

vcenter server

vcloud director

vrealize automation

identity appliance

session hijacking

remote attack

7.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

7.2 High

AI Score

Confidence

High

6.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.004 Low

EPSS

Percentile

72.8%

JSON

Client Integration Plugin (CIP) in VMware vCenter Server 5.5 U3a, U3b, and U3c and 6.0 before U2; vCloud Director 5.5.5; and vRealize Automation Identity Appliance 6.2.4 before 6.2.4.1 mishandles session content, which allows remote attackers to hijack sessions via a crafted web site.

Affected configurations

NVD

Node

vmwarevcenter_serverRange≤6.01b

vmwarevcenter_serverMatch5.53a

vmwarevcenter_serverMatch5.53b

vmwarevcenter_serverMatch5.5u3c

vmwarevcloud_automation_identity_applianceMatch6.2.4

vmwarevcloud_directorMatch5.5.5

CPENameOperatorVersion
vmware:vcenter_servervmware vcenter serverle6.0
vmware:vcenter_servervmware vcenter servereq5.5
vmware:vcloud_automation_identity_appliancevmware vcloud automation identity applianceeq6.2.4
vmware:vcloud_directorvmware vcloud directoreq5.5.5

CPE	Name	Operator	Version
vmware:vcenter_server	vmware vcenter server	le	6.0
vmware:vcenter_server	vmware vcenter server	eq	5.5
vmware:vcloud_automation_identity_appliance	vmware vcloud automation identity appliance	eq	6.2.4
vmware:vcloud_director	vmware vcloud director	eq	5.5.5

References

www.securitytracker.com/id/1035570

www.securitytracker.com/id/1035571

www.securitytracker.com/id/1035572

www.vmware.com/security/advisories/VMSA-2016-0004.html

7.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

7.2 High

AI Score

Confidence

High

6.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.004 Low

EPSS

Percentile

72.8%

JSON

Related for CVE-2016-2076

openvas1 vmware1 nvd1 prion1 nessus2 cvelist1