CVE-2016-7458
published 2016-12-29CVE-2016-7458: VMware vSphere Client 5.5 before U3e and 6.0 before U2a allows remote vCenter Server and ESXi instances to read arbitrary files via an XML document containing…
PriorityP433medium5.8CVSS 3.0
AVNACLPRNUINSCCLINAN
EPSS
1.23%
65.3th percentile
VMware vSphere Client 5.5 before U3e and 6.0 before U2a allows remote vCenter Server and ESXi instances to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | esxi | — | — |
| vmware | vmware_vcenter_server | — | — |
| vmware | vmware_vsphere | — | — |
| vmware | vsphere_client | — | — |
| vmware | vsphere_client | — | — |
CVSS provenance
nvdv3.05.8MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VMware
VMware product updates address information disclosure vulnerabilities
vendor_vmware·2016-11-22·CVSS 5.8
CVE-2016-7458 [MEDIUM] VMware product updates address information disclosure vulnerabilities
VMSA-2016-0022: VMware product updates address information disclosure vulnerabilities
a. vSphere Client XML External Entity vulnerability The vSphere Client contains an XML External Entity (XXE) vulnerability. This issue can lead to information disclosure if a vSphere Client user is tricked into connecting to a malicious instance of vCenter Server or ESXi. There are no known workarounds for this issue. VMware would like to thank Vladimir Ivanov, Andrey Evlanin, Mikhail Stepankin, Artem Kondratenko, Arseniy Sharoglazov of Positive Technologies for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2016-7458 to this issue. Column 5 of the following table lists the action required to remediate the vulnerability in each
GHSA
GHSA-5278-x3fc-5hx6: VMware vSphere Client 5
ghsa_unreviewed·2022-05-17
CVE-2016-7458 [MEDIUM] CWE-611 GHSA-5278-x3fc-5hx6: VMware vSphere Client 5
VMware vSphere Client 5.5 before U3e and 6.0 before U2a allows remote vCenter Server and ESXi instances to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
No detection rules found.
No public exploits indexed.
2016-12-29
Published