DOM-Based Cross-Site Scripting Vulnerability in VMware vRealize Automation
CVE-2018-6958

6.1MEDIUM

Key Information:

Vendor

Vmware
Status
Vrealize Automation
Vendor
CVE Published:
12 April 2018

What is CVE-2018-6958?

VMware vRealize Automation prior to version 7.3.1 is susceptible to a DOM-based cross-site scripting vulnerability. This flaw can be exploited by attackers to execute malicious scripts in the context of the user's session, potentially compromising their workstation. Users of vRA should implement appropriate security measures to mitigate the risk and ensure their systems are updated to the latest version.

Affected Version(s)

vRealize Automation prior to 7.3.1

References

http://www.securityfocus.com/bid/103752
vdb-entryx_refsource_BID
http://www.vmware.com/security/advisories/VMSA-2018-0009....
x_refsource_CONFIRM
http://www.securitytracker.com/id/1040676
vdb-entryx_refsource_SECTRACK

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.