CVE-2017-4928

Name of the Vulnerable Software and Affected Versions vSphere Web Client versions 6.0 prior to 6.0 U3c vSphere Web Client versions 5.5 prior to 5.5 U3f

Description The flash-based vSphere Web Client contains issues due to improper neutralization of URLs, specifically Server-Side Request Forgery (SSRF) and CRLF injection. An attacker may exploit these issues by sending a POST request with modified headers towards internal services, leading to information disclosure.

Recommendations For vSphere Web Client versions 6.0 prior to 6.0 U3c, update to version 6.0 U3c or later. For vSphere Web Client versions 5.5 prior to 5.5 U3f, update to version 5.5 U3f or later.