Server-Side Request Forgery and CRLF Injection in VMware vSphere Web Client
CVE-2017-4928
7.5HIGH
What is CVE-2017-4928?
The Flash-based VMware vSphere Web Client, versions 5.5 and 6.0 prior to specified updates, is susceptible to Server-Side Request Forgery (SSRF) and CRLF injection vulnerabilities due to inadequate handling of URLs. An attacker can exploit these weaknesses by crafting specially formatted POST requests, potentially leading to unauthorized access to internal services and information disclosure. Users are advised to update to the latest versions to mitigate these risks.
Affected Version(s)
vSphere Web Client 6.0 prior to 6.0 U3c
vSphere Web Client 5.5 prior to 5.5 U3f