PT-2017-16211
CVE-2017-4928
·
تاريخ النشر
2017-11-17
·
تاريخ التحديث
2018-10-30
الوصف من
CVSS 3.1
7.5
عاليةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
vSphere Web Client versions 6.0 prior to 6.0 U3c
vSphere Web Client versions 5.5 prior to 5.5 U3f
Description
The flash-based vSphere Web Client contains issues due to improper neutralization of URLs, specifically Server-Side Request Forgery (SSRF) and CRLF injection. An attacker may exploit these issues by sending a POST request with modified headers towards internal services, leading to information disclosure.
Recommendations
For vSphere Web Client versions 6.0 prior to 6.0 U3c, update to version 6.0 U3c or later.
For vSphere Web Client versions 5.5 prior to 5.5 U3f, update to version 5.5 U3f or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾