CVE-2016-7462: High severity vmware vrealize operations vulnerability
Published Dec 29, 2016
·Updated
The Suite REST API in VMware vRealize Operations (aka vROps) 6.x before 6.4.0 allows remote authenticated users to write arbitrary content to files or rename files via a crafted DiskFileItem in a relay-request payload that is mishandled during deserialization.
Affected Software
5 affected components
VMware vRealize Operations=6.0.0
VMware vRealize Operations=6.1.0
VMware vRealize Operations=6.2.0a
VMware vRealize Operations=6.2.1
VMware vRealize Operations=6.3.0
Event History
Dec 29, 2016
CVE Published
via MITRE·09:02 AM
Data Sourced
via MITRE·09:02 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-7462?
CVE-2016-7462 has a moderate severity level due to its potential for unauthorized file write operations.
2
How do I fix CVE-2016-7462?
To fix CVE-2016-7462, upgrade VMware vRealize Operations to version 6.4.0 or higher.
3
Who is affected by CVE-2016-7462?
CVE-2016-7462 affects remote authenticated users of VMware vRealize Operations versions 6.0.0 through 6.3.0.
4
What type of attack does CVE-2016-7462 facilitate?
CVE-2016-7462 facilitates arbitrary file write and file renaming attacks through deserialization issues.
5
Is CVE-2016-7462 an authenticated vulnerability?
Yes, CVE-2016-7462 requires remote authenticated access to exploit the vulnerability.