vulnwire
9.8crit

CVE-2017-4923in critical feed

VMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure vulnerability.

Published 9 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.9%
percentile 79%
Public exploits
0
none known

VMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure vulnerability. This issue may allow plaintext credentials to be obtained when using the vCenter Server Appliance file-based backup feature.

Exploit prediction (EPSS)

1.86% probability of exploitation in the next 30 days, higher than 79% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-522 Insufficiently Protected Credentials
Technology feeds
VMware (RSS, critical only)

References

  • vmware.com /security/advisories/VMSA-2017-0013.html · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/99997 · vdb-entry, x_refsource_BID, x_transferred
  • securitytracker.com /id/1039013 · vdb-entry, x_refsource_SECTRACK, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.