Advisory Published


First published: Wed Sep 18 2019(Updated: )

VMware vSphere ESXi (6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to ESXi600-201807103-SG) and VMware vCenter Server (6.7 prior to 6.7 U1b, 6.5 prior to 6.5 U2b, and 6.0 prior to 6.0 U3j) contain an information disclosure vulnerability in clients arising from insufficient session expiration. An attacker with physical access or an ability to mimic a websocket connection to a user’s browser may be able to obtain control of a VM Console after the user has logged out or their session has timed out.


Affected SoftwareAffected VersionHow to fix
VMware ESXi=6.7-670-201811001
VMware vSphere ESXi=6.7
VMware vSphere ESXi=6.7-update_1
VMware vSphere ESXi=6.5-a
VMware vSphere ESXi=6.5-u2
VMware vSphere ESXi=6.5
VMware vSphere ESXi=6.5-650-201810002
VMware vSphere ESXi=6.5-650-201811001
VMware vSphere ESXi=6.5-650-201811002
VMware vSphere ESXi=6.5-650-201901001
VMware vSphere ESXi=6.5-650-201903001
VMware vSphere ESXi=6.5-650-201905001
VMware vSphere ESXi=6.5-update_1
VMware vSphere ESXi=6.0
VMware vSphere ESXi=6.0-600-201810001
VMware vSphere ESXi=6.0-600-201811001
VMware vSphere ESXi=6.0-600-201903001
VMware vSphere ESXi=6.0-600-201905001
VMware vSphere ESXi=6.0-beta
VMware vSphere ESXi=6.0-u1a
VMware vSphere ESXi=6.0-u1b
VMware vSphere ESXi=6.0-u3a
VMware vSphere ESXi=6.0-update_2
VMware vSphere ESXi=6.0-update_3
VMware vCenter Server=6.0
VMware vCenter Server=6.0-a
VMware vCenter Server=6.0-b
VMware vCenter Server=6.0-u1
VMware vCenter Server=6.0-u1b
VMware vCenter Server=6.0-u3
VMware vCenter Server=6.0-update2
VMware vCenter Server=6.0-update2a
VMware vCenter Server=6.0-update2m
VMware vCenter Server=6.0-update3a
VMware vCenter Server=6.0-update3b
VMware vCenter Server=6.0-update3c
VMware vCenter Server=6.0-update3d
VMware vCenter Server=6.0-update3e
VMware vCenter Server=6.0-update3f
VMware vCenter Server=6.0-update3g
VMware vCenter Server=6.0-update3h
VMware vCenter Server=6.0-update3i
VMware vCenter Server=6.7
VMware vCenter Server=6.7-a
VMware vCenter Server=6.7-b
VMware vCenter Server=6.7-c
VMware vCenter Server=6.7-d
VMware vCenter Server=6.7-update1
VMware vCenter Server=6.7-update1b
VMware vCenter Server=6.7-update2
VMware vCenter Server=6.7-update2a
VMware vCenter Server=6.7-update2c
VMware vCenter Server=6.5
VMware vCenter Server=6.5-a
VMware vCenter Server=6.5-b
VMware vCenter Server=6.5-c
VMware vCenter Server=6.5-d
VMware vCenter Server=6.5-update1
VMware vCenter Server=6.5-update1b
VMware vCenter Server=6.5-update1c
VMware vCenter Server=6.5-update1d
VMware vCenter Server=6.5-update1e
VMware vCenter Server=6.5-update1g
VMware vCenter Server=6.5-update2
VMware vCenter Server=6.5-update2b
VMware vCenter Server=6.5-update2c
VMware vCenter Server=6.5-update2d
VMware vCenter Server=6.5-update2g

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.


SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203