Vulnerability Details : CVE-2011-2217

Public exploit exists!
Certain ActiveX controls in (1) tsgetxu71ex552.dll and (2) tsgetx71ex552.dll in Tom Sawyer GET Extension Factory 5.5.2.237, as used in VI Client (aka VMware Infrastructure Client) 2.0.2 before Build 230598 and 2.5 before Build 204931 in VMware Infrastructure 3, do not properly handle attempted initialization within Internet Explorer, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted HTML document.
Published 2011-06-06 19:55:04
Updated 2017-08-29 01:29:20
Source MITRE
View at NVD,   CVE.org
Vulnerability category: OverflowMemory CorruptionExecute codeDenial of service

Exploit prediction scoring system (EPSS) score for CVE-2011-2217

EPSS FAQ
94.90%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2011-2217

  • Tom Sawyer Software GET Extension Factory Remote Code Execution
    Disclosure Date: 2011-05-03
    First seen: 2020-04-26
    exploit/windows/browser/tom_sawyer_tsgetx71ex552
    This module exploits a remote code execution vulnerability in the tsgetx71ex553.dll ActiveX control installed with Tom Sawyer GET Extension Factory due to an incorrect initialization under Internet Explorer. While the Tom Sawyer GET Extension Factory is installed

CVSS scores for CVE-2011-2217

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
9.3
 HIGH AV:N/AC:M/Au:N/C:C/I:C/A:C
8.6
10.0
 NIST

CWE ids for CVE-2011-2217

  • The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
    Assigned by: nvd@nist.gov (Primary)

References for CVE-2011-2217

Products affected by CVE-2011-2217

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close