CVE-2017-4947

CRITICAL

Vmware Vrealize Automation < 1.3.0 - Insecure Deserialization

Title source: rule

Description

VMware vRealize Automation (7.3 and 7.2) and vSphere Integrated Containers (1.x before 1.3) contain a deserialization vulnerability via Xenon. Successful exploitation of this issue may allow remote attackers to execute arbitrary code on the appliance.

References (4)

Scores

CVSS v3 9.8
EPSS 0.2664
EPSS Percentile 96.3%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE
CWE-502
Status published

Affected Products (3)

vmware/vrealize_automation
vmware/vrealize_automation
vmware/vsphere_integrated_containers < 1.3.0

Timeline

Published Jan 29, 2018
Tracked Since Feb 18, 2026