CVE-2017-4943: High severity vmware vcenter vulnerability

Published Dec 20, 2017

Updated

VMware vCenter Server Appliance (vCSA) (6.5 before 6.5 U1d) contains a local privilege escalation vulnerability via the 'showlog' plugin. Successful exploitation of this issue could result in a low privileged user gaining root level privileges over the appliance base OS.

Affected Software

9 affected components

VMware vCenter Server=6.5-a

VMware vCenter Server=6.5-b

VMware vCenter Server=6.5-c

VMware vCenter Server=6.5-d

VMware vCenter Server=6.5-e

VMware vCenter Server=6.5-f

VMware vCenter Server=6.5-update1

VMware vCenter Server=6.5-update1b

VMware vCenter Server=6.5-update1c

Remediation

Patch Available

https://www.vmware.com/security/advisories/VMSA-2017-0021.html

Event History

Dec 20, 2017

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2017-4943.

What is the severity of CVE-2017-4943?

The severity of CVE-2017-4943 is high, with a severity value of 7.8.

What software versions are affected by CVE-2017-4943?

CVE-2017-4943 affects VMware vCenter Server Appliance (vCSA) version 6.5 before 6.5 U1d.

How can this vulnerability be exploited?

This vulnerability can be exploited by a low privileged user gaining root level privileges over the appliance base OS through the 'showlog' plugin.

Are there any references or sources for more information?

Yes, you can find more information about CVE-2017-4943 at the following references: [SecurityTracker](http://www.securitytracker.com/id/1040026) and [VMware Security Advisories](https://www.vmware.com/security/advisories/VMSA-2017-0021.html).