CVE-2016-7458 VMware vSphere Client 5.5 before U3e and 6.0 before U2a allows remote vCenter Server and ESXi instances to read arbitrary files via an XML document containing an external entity declaration in conjunc...
MediumCVSS 5.8
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
VMware vSphere Client 5.5 before U3e and 6.0 before U2a allows remote vCenter Server and ESXi instances to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| VMware vsphere client | = 5.5 | No fix listed |
| VMware vsphere client | = 5.5-u1 | No fix listed |
| VMware vsphere client | = 5.5-u2 | No fix listed |
| VMware vsphere client | = 5.5-u3a | No fix listed |
| VMware vsphere client | = 5.5-u3b | No fix listed |
| VMware vsphere client | = 6.0 | No fix listed |
| VMware vsphere client | = 6.0-2 | No fix listed |
| VMware vsphere client | = 6.0-2m | No fix listed |
| VMware vsphere client | = 6.0-a | No fix listed |
| VMware vsphere client | = 6.0-b | No fix listed |
| VMware vsphere client | = 6.0-u1 | No fix listed |
| VMware vsphere client | = 6.0-u1b | No fix listed |
References
- 94483 third-party-advisory vdb-entry
- 1037328 vdb-entry
- www.vmware.com vendor-advisory