CVE-2016-7460

CRITICAL

VMware vRealize Automation 6.x < 6.2.5 - XML External Entity Injection

Title source: llm
STIX 2.1

Description

The Single Sign-On feature in VMware vCenter Server 5.5 before U3e and 6.0 before U2a and vRealize Automation 6.x before 6.2.5 allows remote attackers to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/94485
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1037329
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1037327

Scores

CVSS v3 9.1
EPSS 0.0201
EPSS Percentile 83.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Details

CWE
CWE-611
Status published
Products (11)
vmware/vrealize_automation 6.0.0
vmware/vrealize_automation 6.0.1
vmware/vrealize_automation 6.0.1.1
vmware/vrealize_automation 6.0.1.2
vmware/vrealize_automation 6.1.0
vmware/vrealize_automation 6.1.1
vmware/vrealize_automation 6.2.0
vmware/vrealize_automation 6.2.1
vmware/vrealize_automation 6.2.2
vmware/vrealize_automation 6.2.3
... and 1 more
Published Dec 29, 2016
Tracked Since Feb 18, 2026