Medium severity · published Aug 1, 2017
CVE-2017-4922
VMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure issue due to the service startup script using world writable directories as temporary storage for…
6.5
CVSS
1.3%
EPSS
No
On KEV
Description
VMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure issue due to the service startup script using world writable directories as temporary storage for critical information. Successful exploitation of this issue may allow unprivileged host users to access certain critical information when the service gets restarted.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VS
vCenter Server · VMware
6.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-4922
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-4922
Third Party Advisory
http://www.securityfocus.com/bid/100012
Third Party Advisory
http://www.securitytracker.com/id/1039013
Patch
https://www.vmware.com/security/advisories/VMSA-2017-0013.html
More from vCenter Server
9.8
CVE-2026-59310
vCenter directory-traversal vulnerability
9.8
CVE-2024-38813
Privilege escalation vulnerability
9.8
CVE-2024-38812
Heap-overflow vulnerability
9.8
CVE-2024-37079
Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability
9.8
CVE-2023-34048
VMware vCenter Server Out-of-Bounds Write Vulnerability