Vulnerability Description
The Suite REST API in VMware vRealize Operations (aka vROps) 6.x before 6.4.0 allows remote authenticated users to write arbitrary content to files or rename files via a crafted DiskFileItem in a relay-request payload that is mishandled during deserialization.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Vmware | Vrealize Operations | 6.0.0 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/94351
- http://www.securitytracker.com/id/1037297
- http://www.vmware.com/security/advisories/VMSA-2016-0020.htmlVendor Advisory
- https://www.tenable.com/security/research/tra-2016-34Technical DescriptionThird Party Advisory
- http://www.securityfocus.com/bid/94351
- http://www.securitytracker.com/id/1037297
- http://www.vmware.com/security/advisories/VMSA-2016-0020.htmlVendor Advisory
- https://www.tenable.com/security/research/tra-2016-34Technical DescriptionThird Party Advisory
FAQ
What is CVE-2016-7462?
CVE-2016-7462 is a vulnerability with a CVSS score of 8.5 (HIGH). The Suite REST API in VMware vRealize Operations (aka vROps) 6.x before 6.4.0 allows remote authenticated users to write arbitrary content to files or rename files via a crafted DiskFileItem in a rela...
How severe is CVE-2016-7462?
CVE-2016-7462 has been rated HIGH with a CVSS base score of 8.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-7462?
Check the references section above for vendor advisories and patch information. Affected products include: Vmware Vrealize Operations.