CVE-2016-7458: XEE
Published Dec 29, 2016
·Updated
VMware vSphere Client 5.5 before U3e and 6.0 before U2a allows remote vCenter Server and ESXi instances to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Affected Software
12 affected components
VMware vSphere Client=5.5
VMware vSphere Client=5.5-u1
VMware vSphere Client=5.5-u2
VMware vSphere Client=5.5-u3a
VMware vSphere Client=5.5-u3b
VMware vSphere Client=6.0
VMware vSphere Client=6.0-2
VMware vSphere Client=6.0-2m
VMware vSphere Client=6.0-a
VMware vSphere Client=6.0-b
VMware vSphere Client=6.0-u1
VMware vSphere Client=6.0-u1b
Event History
Dec 29, 2016
CVE Published
via MITRE·09:02 AM
Data Sourced
via MITRE·09:02 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-7458?
CVE-2016-7458 is considered a critical vulnerability due to its potential for remote file reading and data exposure.
2
How do I fix CVE-2016-7458?
To fix CVE-2016-7458, upgrade to VMware vSphere Client versions 5.5 U3e or 6.0 U2a or later.
3
What systems are affected by CVE-2016-7458?
CVE-2016-7458 affects VMware vSphere Client versions 5.5 before U3e and 6.0 before U2a.
4
What types of attacks can exploit CVE-2016-7458?
CVE-2016-7458 can be exploited through XML External Entity (XXE) injection attacks.
5
Is there a workaround for CVE-2016-7458?
No effective workaround exists for CVE-2016-7458 other than applying the recommended updates.