Server-Side Request Forgery and CRLF Injection in VMware vSphere Web Client
CVE-2017-4928
7.5HIGH
Summary
The Flash-based VMware vSphere Web Client, versions 5.5 and 6.0 prior to specified updates, is susceptible to Server-Side Request Forgery (SSRF) and CRLF injection vulnerabilities due to inadequate handling of URLs. An attacker can exploit these weaknesses by crafting specially formatted POST requests, potentially leading to unauthorized access to internal services and information disclosure. Users are advised to update to the latest versions to mitigate these risks.
Affected Version(s)
vSphere Web Client 6.0 prior to 6.0 U3c
vSphere Web Client 5.5 prior to 5.5 U3f
References
CVSS V3.1
Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved