CVE-2017-4928

State: Published
Severity: Not scored
Published: Nov 17, 2017
Updated: Sep 17, 2024
Reserved: Dec 26, 2016

Description

The flash-based vSphere Web Client (6.0 prior to 6.0 U3c and 5.5 prior to 5.5 U3f) i.e. not the new HTML5-based vSphere Client, contains SSRF and CRLF injection issues due to improper neutralization of URLs. An attacker may exploit these issues by sending a POST request with modified headers towards internal services leading to information disclosure.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
vSphere Web ClientVMware	6.0 prior to 6.0 U3cAffected 5.5 prior to 5.5 U3fAffected

References

https://www.vmware.com/security/advisories/VMSA-2017-0017.html
1039759vdb-entry
101785vdb-entry

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.