CVE-2016-7462 The Suite REST API in VMware vRealize Operations (aka vROps) 6.x before 6.4.0 allows remote authenticated users to write arbitrary content to files or rename files via a crafted DiskFileItem in a rela...

HighCVSS 8.5 EPSS 2.0%

Published: 2016-12-29 11:02
Updated: 2026-06-17 03:53
Exploit status: No public exploit known

Description

The Suite REST API in VMware vRealize Operations (aka vROps) 6.x before 6.4.0 allows remote authenticated users to write arbitrary content to files or rename files via a crafted DiskFileItem in a relay-request payload that is mishandled during deserialization.

Affected products

Product	Affected versions	Fixed in
VMware vrealize operations	= 6.0.0	No fix listed
VMware vrealize operations	= 6.1.0	No fix listed
VMware vrealize operations	= 6.2.0a	No fix listed
VMware vrealize operations	= 6.2.1	No fix listed
VMware vrealize operations	= 6.3.0	No fix listed

References

94351 vdb-entry
1037297 vdb-entry
www.vmware.com vendor-advisory
www.tenable.com technical-description third-party-advisory

CVSS v3.0

8.5 High

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Changed
Confidentiality: None
Integrity: Low
Availability: High

All scores (2)

v3.0 8.5 · nvd@nist.gov
v2.0 7.5 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 2.05% (percentile 81.5)
CWE: CWE-264 CWE-749

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.