CVE-2017-4917

CRITICAL

VMware vSphere Data Protection 5.5.x-6.1.x - Plaintext Credential Exposure via Reversible Encryption

Title source: llm
STIX 2.1

Description

VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x locally stores vCenter Server credentials using reversible encryption. This issue may allow plaintext credentials to be obtained.

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/98936
Patch, Vendor Advisory x_refsource_confirm
http://www.vmware.com/security/advisories/VMSA-2017-0010.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1038617

Scores

CVSS v3 9.8
EPSS 0.0008
EPSS Percentile 23.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-327
Status published
Products (25)
VMware/vSphere Data Protection (VDP) 5.5.x
VMware/vSphere Data Protection (VDP) 5.8.x
VMware/vSphere Data Protection (VDP) 6.0.x
VMware/vSphere Data Protection (VDP) 6.1.x
vmware/vsphere_data_protection 5.5.5
vmware/vsphere_data_protection 5.5.6
vmware/vsphere_data_protection 5.5.7
vmware/vsphere_data_protection 5.5.8
vmware/vsphere_data_protection 5.5.9
vmware/vsphere_data_protection 5.5.10
... and 15 more
Published Jun 07, 2017
Tracked Since Feb 18, 2026