Vulnerability Details : CVE-2016-7460
The Single Sign-On feature in VMware vCenter Server 5.5 before U3e and 6.0 before U2a and vRealize Automation 6.x before 6.2.5 allows remote attackers to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Vulnerability category: XML external entity (XXE) injectionDenial of service
Products affected by CVE-2016-7460
- cpe:2.3:a:vmware:vrealize_automation:6.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vrealize_automation:6.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vrealize_automation:6.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vrealize_automation:6.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vrealize_automation:6.0.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vrealize_automation:6.0.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vrealize_automation:6.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vrealize_automation:6.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vrealize_automation:6.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vrealize_automation:6.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vrealize_automation:6.0.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-7460
1.13%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 83 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-7460
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.4
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:P |
10.0
|
4.9
|
NIST | |
|
9.1
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
3.9
|
5.2
|
NIST |
CWE ids for CVE-2016-7460
-
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-7460
-
http://www.securitytracker.com/id/1037329
VMware vCenter Server XML External Entity Processing Flaws Let Remote Users Obtain Potentially Sensitive Information or Deny Service - SecurityTracker
-
http://www.securitytracker.com/id/1037327
VMware vRealize Automation XML External Entity Processing Flaw in Single Sign-On Function Lets Remote Users Obtain Potentially Sensitive Information or Deny Service - SecurityTracker
-
http://www.vmware.com/security/advisories/VMSA-2016-0022.html
VMSA-2016-0022Vendor Advisory
-
http://www.securityfocus.com/bid/94485
Multiple VMware Products CVE-2016-7460 XML External Entity Injection VulnerabilityThird Party Advisory;VDB Entry
Jump to