vulnwire
7.5high

CVE-2017-4952

VMware Xenon 1.x, prior to 1.5.4-CR7_1, 1.5.7_7, 1.5.4-CR6_2, 1.3.7-CR1_2, 1.1.0-CR0-3, 1.1.0-CR3_1,1.4.2-CR4_1, and 1.5.4_8, contains an a…

Published 8 y ago · modified 4 mo ago · JSON

CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
3.7%
percentile 90%
Public exploits
0
none known

VMware Xenon 1.x, prior to 1.5.4-CR7_1, 1.5.7_7, 1.5.4-CR6_2, 1.3.7-CR1_2, 1.1.0-CR0-3, 1.1.0-CR3_1,1.4.2-CR4_1, and 1.5.4_8, contains an authentication bypass vulnerability due to insufficient access controls for utility endpoints. Successful exploitation of this issue may result in information disclosure.

Exploit prediction (EPSS)

3.73% probability of exploitation in the next 30 days, higher than 90% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.07.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • VMware VMware Xenon

Classification

Weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource

References

  • github.com /vmware/xenon/commit/b1fd306047ecdac82661d636ebee801a7f2b3a0a · x_refsource_CONFIRM, x_transferred
  • github.com /vmware/xenon/commit/30ae41bccf418d88b52b35a81efb3c1304b798f8 · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/103093 · vdb-entry, x_refsource_BID, x_transferred
  • github.com /vmware/xenon/commit/756d893573414eec8635c2aba2345c4dcf10b21c · x_refsource_CONFIRM, x_transferred
  • seclists.org /oss-sec/2018/q1/153 · mailing-list, x_refsource_MLIST, x_transferred
  • github.com /vmware/xenon/commit/5682ef8d40569afd00fb9a5933e7706bb5b66713 · x_refsource_CONFIRM, x_transferred
  • github.com /vmware/xenon/commit/ec30db9afada9cb52852082ce4d7d0095524f3b3 · x_refsource_CONFIRM, x_transferred
  • github.com /vmware/xenon/commit/055ae13603f0cc3cd7cf59f20ce314bf8db583e1 · x_refsource_CONFIRM, x_transferred
  • github.com /vmware/xenon/commit/c23964eb57e846126daef98ef7ed15400313e977 · x_refsource_CONFIRM, x_transferred
  • github.com /vmware/xenon/commit/7a747d82b80cd38d2c11a0d9cdedb71c722a2c75 · x_refsource_CONFIRM, x_transferred
  • github.com /vmware/xenon/commit/06b9947cf603ba40fd8b03bfeb2e84528a7ab592 · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.