Lucene search

VmwareCVE-2016-7459

HistoryDec 29, 2016 - 9:59 a.m.

CVE-2016-7459

2016-12-2909:59:00

CWE-611

vmware

web.nvd.nist.gov

vmware

vcenter server

xml external entity

xxe

cve-2016-7459

security vulnerability

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

7.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

42.0%

JSON

VMware vCenter Server 5.5 before U3e and 6.0 before U2a allows remote authenticated users to read arbitrary files via a (1) Log Browser, (2) Distributed Switch setup, or (3) Content Library XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Affected configurations

Nvd

Node

vmwarevcenter_serverMatch5.0

vmwarevcenter_serverMatch5.5

vmwarevcenter_serverMatch5.51

vmwarevcenter_serverMatch5.52

vmwarevcenter_serverMatch5.53a

vmwarevcenter_serverMatch5.53b

vmwarevcenter_serverMatch6.0

vmwarevcenter_serverMatch6.01

vmwarevcenter_serverMatch6.01b

vmwarevcenter_serverMatch6.02

vmwarevcenter_serverMatch6.02m

vmwarevcenter_serverMatch6.0a

vmwarevcenter_serverMatch6.0b

VendorProductVersionCPE
vmwarevcenter_server5.0cpe:2.3:a:vmware:vcenter_server:5.0:*:*:*:*:*:*:*
vmwarevcenter_server5.5cpe:2.3:a:vmware:vcenter_server:5.5:*:*:*:*:*:*:*
vmwarevcenter_server5.5cpe:2.3:a:vmware:vcenter_server:5.5:1:*:*:*:*:*:*
vmwarevcenter_server5.5cpe:2.3:a:vmware:vcenter_server:5.5:2:*:*:*:*:*:*
vmwarevcenter_server5.5cpe:2.3:a:vmware:vcenter_server:5.5:3a:*:*:*:*:*:*
vmwarevcenter_server5.5cpe:2.3:a:vmware:vcenter_server:5.5:3b:*:*:*:*:*:*
vmwarevcenter_server6.0cpe:2.3:a:vmware:vcenter_server:6.0:*:*:*:*:*:*:*
vmwarevcenter_server6.0cpe:2.3:a:vmware:vcenter_server:6.0:1:*:*:*:*:*:*
vmwarevcenter_server6.0cpe:2.3:a:vmware:vcenter_server:6.0:1b:*:*:*:*:*:*
vmwarevcenter_server6.0cpe:2.3:a:vmware:vcenter_server:6.0:2:*:*:*:*:*:*

Vendor	Product	Version	CPE
vmware	vcenter_server	5.0	cpe:2.3:a:vmware:vcenter_server:5.0:::::::*
vmware	vcenter_server	5.5	cpe:2.3:a:vmware:vcenter_server:5.5:::::::*
vmware	vcenter_server	5.5	cpe:2.3:a:vmware:vcenter_server:5.5:1::::::
vmware	vcenter_server	5.5	cpe:2.3:a:vmware:vcenter_server:5.5:2::::::
vmware	vcenter_server	5.5	cpe:2.3:a:vmware:vcenter_server:5.5:3a::::::
vmware	vcenter_server	5.5	cpe:2.3:a:vmware:vcenter_server:5.5:3b::::::
vmware	vcenter_server	6.0	cpe:2.3:a:vmware:vcenter_server:6.0:::::::*
vmware	vcenter_server	6.0	cpe:2.3:a:vmware:vcenter_server:6.0:1::::::
vmware	vcenter_server	6.0	cpe:2.3:a:vmware:vcenter_server:6.0:1b::::::
vmware	vcenter_server	6.0	cpe:2.3:a:vmware:vcenter_server:6.0:2::::::

Rows per page:

1-10 of 131

References

www.securityfocus.com/bid/94486

www.securitytracker.com/id/1037329

www.vmware.com/security/advisories/VMSA-2016-0022.html

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

7.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

42.0%

JSON

Related for CVE-2016-7459