Medium severity · published Dec 29, 2016
CVE-2016-7458
VMware vSphere Client 5.5 before U3e and 6.0 before U2a allows remote vCenter Server and ESXi instances to read arbitrary files via an XML document containing an external entity…
5.8
CVSS
1.2%
EPSS
No
On KEV
Description
VMware vSphere Client 5.5 before U3e and 6.0 before U2a allows remote vCenter Server and ESXi instances to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VC
Vsphere Client · Vmware
5.5; 5.5; 5.5; 5.5; 5.5; 6.0; +6 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-7458
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-7458
Third Party Advisory
http://www.securityfocus.com/bid/94483
www.securitytracker.com
http://www.securitytracker.com/id/1037328
Vendor Advisory
http://www.vmware.com/security/advisories/VMSA-2016-0022.html
More from Vsphere Client
–
CVE-2014-1210
VMware vSphere Client 5.0 before Update 3 and 5.1 before Update 2 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via…
–
CVE-2014-1209
VMware vSphere Client 4.0, 4.1, 5.0 before Update 3, and 5.1 before Update 2 does not properly validate updates to Client files, which allows remote attackers to trigger the…
–
CVE-2013-1405
VMware vCenter Server 4.0 before Update 4b and 4.1 before Update 3a, VMware VirtualCenter 2.5, VMware vSphere Client 4.0 before Update 4b and 4.1 before Update 3a, VMware…