Server-Side Request Forgery and CRLF Injection in VMware vSphere Web Client
CVE-2017-4928

7.5HIGH

Key Information:

Vendor

Vmware
Status
Vsphere Web Client
Vendor
CVE Published:
17 November 2017

What is CVE-2017-4928?

The Flash-based VMware vSphere Web Client, versions 5.5 and 6.0 prior to specified updates, is susceptible to Server-Side Request Forgery (SSRF) and CRLF injection vulnerabilities due to inadequate handling of URLs. An attacker can exploit these weaknesses by crafting specially formatted POST requests, potentially leading to unauthorized access to internal services and information disclosure. Users are advised to update to the latest versions to mitigate these risks.

Affected Version(s)

vSphere Web Client 6.0 prior to 6.0 U3c

vSphere Web Client 5.5 prior to 5.5 U3f

References

https://www.vmware.com/security/advisories/VMSA-2017-0017...
x_refsource_CONFIRM
http://www.securitytracker.com/id/1039759
vdb-entryx_refsource_SECTRACK
http://www.securityfocus.com/bid/101785
vdb-entryx_refsource_BID

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.