Vulnerabilites related to vmware - vsphere_integrated_containers
cve-2017-4947
Vulnerability from cvelistv5
Published
2018-01-29 16:00
Modified
2024-09-17 01:46
Severity ?
EPSS score ?
Summary
VMware vRealize Automation (7.3 and 7.2) and vSphere Integrated Containers (1.x before 1.3) contain a deserialization vulnerability via Xenon. Successful exploitation of this issue may allow remote attackers to execute arbitrary code on the appliance.
References
▼ | URL | Tags |
---|---|---|
http://www.securityfocus.com/bid/102852 | vdb-entry, x_refsource_BID | |
https://www.vmware.com/security/advisories/VMSA-2018-0006.html | x_refsource_CONFIRM | |
http://www.securitytracker.com/id/1040289 | vdb-entry, x_refsource_SECTRACK | |
http://www.securitytracker.com/id/1040290 | vdb-entry, x_refsource_SECTRACK |
Impacted products
Vendor | Product | Version | |||||
---|---|---|---|---|---|---|---|
▼ | VMware | vRealize Automation |
Version: 7.3 and 7.2 |
||||
|
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T14:47:43.285Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "102852", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/102852", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://www.vmware.com/security/advisories/VMSA-2018-0006.html", }, { name: "1040289", tags: [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred", ], url: "http://www.securitytracker.com/id/1040289", }, { name: "1040290", tags: [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred", ], url: "http://www.securitytracker.com/id/1040290", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "vRealize Automation", vendor: "VMware", versions: [ { status: "affected", version: "7.3 and 7.2", }, ], }, { defaultStatus: "unaffected", product: "vSphere Integrated Containers", vendor: "VMware", versions: [ { status: "affected", version: "1.x before 1.3", }, ], }, ], datePublic: "2018-01-26T00:00:00.000Z", descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "<p>VMware vRealize Automation (7.3 and 7.2) and vSphere Integrated Containers (1.x before 1.3) contain a deserialization vulnerability via Xenon. Successful exploitation of this issue may allow remote attackers to execute arbitrary code on the appliance.</p>", }, ], value: "VMware vRealize Automation (7.3 and 7.2) and vSphere Integrated Containers (1.x before 1.3) contain a deserialization vulnerability via Xenon. Successful exploitation of this issue may allow remote attackers to execute arbitrary code on the appliance.", }, ], problemTypes: [ { descriptions: [ { description: "Deserialization vulnerability via Xenon", lang: "en", }, ], }, ], providerMetadata: { dateUpdated: "2023-06-27T14:20:58.305Z", orgId: "dcf2e128-44bd-42ed-91e8-88f912c1401d", shortName: "vmware", }, references: [ { name: "102852", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/102852", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://www.vmware.com/security/advisories/VMSA-2018-0006.html", }, { name: "1040289", tags: [ "vdb-entry", "x_refsource_SECTRACK", ], url: "http://www.securitytracker.com/id/1040289", }, { name: "1040290", tags: [ "vdb-entry", "x_refsource_SECTRACK", ], url: "http://www.securitytracker.com/id/1040290", }, ], source: { discovery: "UNKNOWN", }, x_generator: { engine: "Vulnogram 0.1.0-dev", }, x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@vmware.com", DATE_PUBLIC: "2018-01-26T00:00:00", ID: "CVE-2017-4947", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "vRealize Automation", version: { version_data: [ { version_value: "7.3 and 7.2", }, ], }, }, { product_name: "vSphere Integrated Containers", version: { version_data: [ { version_value: "1.x before 1.3", }, ], }, }, ], }, vendor_name: "VMware", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "VMware Realize Automation (7.3 and 7.2) and vSphere Integrated Containers (1.x before 1.3) contain a deserialization vulnerability via Xenon. Successful exploitation of this issue may allow remote attackers to execute arbitrary code on the appliance.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Deserialization vulnerability via Xenon", }, ], }, ], }, references: { reference_data: [ { name: "102852", refsource: "BID", url: "http://www.securityfocus.com/bid/102852", }, { name: "https://www.vmware.com/security/advisories/VMSA-2018-0006.html", refsource: "CONFIRM", url: "https://www.vmware.com/security/advisories/VMSA-2018-0006.html", }, { name: "1040289", refsource: "SECTRACK", url: "http://www.securitytracker.com/id/1040289", }, { name: "1040290", refsource: "SECTRACK", url: "http://www.securitytracker.com/id/1040290", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "dcf2e128-44bd-42ed-91e8-88f912c1401d", assignerShortName: "vmware", cveId: "CVE-2017-4947", datePublished: "2018-01-29T16:00:00Z", dateReserved: "2016-12-26T00:00:00", dateUpdated: "2024-09-17T01:46:48.338Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
Vulnerability from fkie_nvd
Published
2018-01-29 16:29
Modified
2024-11-21 03:26
Severity ?
Summary
VMware vRealize Automation (7.3 and 7.2) and vSphere Integrated Containers (1.x before 1.3) contain a deserialization vulnerability via Xenon. Successful exploitation of this issue may allow remote attackers to execute arbitrary code on the appliance.
References
▼ | URL | Tags | |
---|---|---|---|
security@vmware.com | http://www.securityfocus.com/bid/102852 | Third Party Advisory, VDB Entry | |
security@vmware.com | http://www.securitytracker.com/id/1040289 | Third Party Advisory, VDB Entry | |
security@vmware.com | http://www.securitytracker.com/id/1040290 | Third Party Advisory, VDB Entry | |
security@vmware.com | https://www.vmware.com/security/advisories/VMSA-2018-0006.html | Patch, Vendor Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/102852 | Third Party Advisory, VDB Entry | |
af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id/1040289 | Third Party Advisory, VDB Entry | |
af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id/1040290 | Third Party Advisory, VDB Entry | |
af854a3a-2127-422b-91ae-364da2661108 | https://www.vmware.com/security/advisories/VMSA-2018-0006.html | Patch, Vendor Advisory |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
vmware | vrealize_automation | 7.2.0 | |
vmware | vrealize_automation | 7.3.0 | |
vmware | vsphere_integrated_containers | * |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:vmware:vrealize_automation:7.2.0:*:*:*:*:*:*:*", matchCriteriaId: "C4DF73CC-89C0-4C85-8F17-C34E435504B3", vulnerable: true, }, { criteria: "cpe:2.3:a:vmware:vrealize_automation:7.3.0:*:*:*:*:*:*:*", matchCriteriaId: "DAF6B998-574C-4CB7-A142-CE4E8F82E5E9", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:vmware:vsphere_integrated_containers:*:*:*:*:*:*:*:*", matchCriteriaId: "3950B3DF-A706-491B-AE01-7A1F81999177", versionEndExcluding: "1.3.0", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "VMware vRealize Automation (7.3 and 7.2) and vSphere Integrated Containers (1.x before 1.3) contain a deserialization vulnerability via Xenon. Successful exploitation of this issue may allow remote attackers to execute arbitrary code on the appliance.", }, { lang: "es", value: "VMware Realize Automation (7.3 y 7.2) y vSphere Integrated Containers (1.x anteriores a 1.3) contienen una vulnerabilidad de deserialización mediante Xenon. La explotación con éxito de este problema podría permitir que atacantes remotos ejecuten código arbitrario en la aplicación.", }, ], id: "CVE-2017-4947", lastModified: "2024-11-21T03:26:44.423", metrics: { cvssMetricV2: [ { acInsufInfo: true, baseSeverity: "HIGH", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "COMPLETE", baseScore: 10, confidentialityImpact: "COMPLETE", integrityImpact: "COMPLETE", vectorString: "AV:N/AC:L/Au:N/C:C/I:C/A:C", version: "2.0", }, exploitabilityScore: 10, impactScore: 10, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.8, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, exploitabilityScore: 3.9, impactScore: 5.9, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2018-01-29T16:29:00.730", references: [ { source: "security@vmware.com", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/102852", }, { source: "security@vmware.com", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securitytracker.com/id/1040289", }, { source: "security@vmware.com", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securitytracker.com/id/1040290", }, { source: "security@vmware.com", tags: [ "Patch", "Vendor Advisory", ], url: "https://www.vmware.com/security/advisories/VMSA-2018-0006.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/102852", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securitytracker.com/id/1040289", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securitytracker.com/id/1040290", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", "Vendor Advisory", ], url: "https://www.vmware.com/security/advisories/VMSA-2018-0006.html", }, ], sourceIdentifier: "security@vmware.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-502", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }