Vulnerability Details CVE-2017-4952
VMware Xenon 1.x, prior to 1.5.4-CR7_1, 1.5.7_7, 1.5.4-CR6_2, 1.3.7-CR1_2, 1.1.0-CR0-3, 1.1.0-CR3_1,1.4.2-CR4_1, and 1.5.4_8, contains an authentication bypass vulnerability due to insufficient access controls for utility endpoints. Successful exploitation of this issue may result in information disclosure.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.01
EPSS Ranking 75.8%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.0
References
- http://seclists.org/oss-sec/2018/q1/153
- http://www.securityfocus.com/bid/103093
- https://github.com/vmware/xenon/commit/055ae13603f0cc3cd7cf59f20ce314bf8db583e1
- https://github.com/vmware/xenon/commit/06b9947cf603ba40fd8b03bfeb2e84528a7ab592
- https://github.com/vmware/xenon/commit/30ae41bccf418d88b52b35a81efb3c1304b798f8
- https://github.com/vmware/xenon/commit/5682ef8d40569afd00fb9a5933e7706bb5b66713
- https://github.com/vmware/xenon/commit/756d893573414eec8635c2aba2345c4dcf10b21c
- https://github.com/vmware/xenon/commit/7a747d82b80cd38d2c11a0d9cdedb71c722a2c75
- https://github.com/vmware/xenon/commit/b1fd306047ecdac82661d636ebee801a7f2b3a0a
- https://github.com/vmware/xenon/commit/c23964eb57e846126daef98ef7ed15400313e977
- https://github.com/vmware/xenon/commit/ec30db9afada9cb52852082ce4d7d0095524f3b3
- http://seclists.org/oss-sec/2018/q1/153
- http://www.securityfocus.com/bid/103093
- https://github.com/vmware/xenon/commit/055ae13603f0cc3cd7cf59f20ce314bf8db583e1
- https://github.com/vmware/xenon/commit/06b9947cf603ba40fd8b03bfeb2e84528a7ab592
- https://github.com/vmware/xenon/commit/30ae41bccf418d88b52b35a81efb3c1304b798f8
- https://github.com/vmware/xenon/commit/5682ef8d40569afd00fb9a5933e7706bb5b66713
- https://github.com/vmware/xenon/commit/756d893573414eec8635c2aba2345c4dcf10b21c
- https://github.com/vmware/xenon/commit/7a747d82b80cd38d2c11a0d9cdedb71c722a2c75
- https://github.com/vmware/xenon/commit/b1fd306047ecdac82661d636ebee801a7f2b3a0a
- https://github.com/vmware/xenon/commit/c23964eb57e846126daef98ef7ed15400313e977
- https://github.com/vmware/xenon/commit/ec30db9afada9cb52852082ce4d7d0095524f3b3
Products affected by CVE-2017-4952
-
cpe:2.3:a:vmware:xenon:1.0.0
-
cpe:2.3:a:vmware:xenon:1.1.0
-
cpe:2.3:a:vmware:xenon:1.1.1
-
cpe:2.3:a:vmware:xenon:1.2.0
-
cpe:2.3:a:vmware:xenon:1.3.0
-
cpe:2.3:a:vmware:xenon:1.3.1
-
cpe:2.3:a:vmware:xenon:1.3.2
-
cpe:2.3:a:vmware:xenon:1.3.3
-
cpe:2.3:a:vmware:xenon:1.3.4
-
cpe:2.3:a:vmware:xenon:1.3.5
-
cpe:2.3:a:vmware:xenon:1.3.6
-
cpe:2.3:a:vmware:xenon:1.3.7
-
cpe:2.3:a:vmware:xenon:1.4.0
-
cpe:2.3:a:vmware:xenon:1.4.1
-
cpe:2.3:a:vmware:xenon:1.4.2
-
cpe:2.3:a:vmware:xenon:1.5.0
-
cpe:2.3:a:vmware:xenon:1.5.1
-
cpe:2.3:a:vmware:xenon:1.5.2
-
cpe:2.3:a:vmware:xenon:1.5.3
-
cpe:2.3:a:vmware:xenon:1.5.4
-
cpe:2.3:a:vmware:xenon:1.5.4_8
-
cpe:2.3:a:vmware:xenon:1.5.7_7