Vulnerability Description
VMware vCenter Server 5.5, 6.0, 6.5 allows vSphere users with certain, limited vSphere privileges to use the VIX API to access Guest Operating Systems without the need to authenticate.
CVSS Score
9.0
CRITICAL
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Vmware | Vcenter Server | 5.5 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/100102Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1039004Third Party AdvisoryVDB Entry
- http://www.vmware.com/security/advisories/VMSA-2017-0012.htmlMitigationVendor Advisory
- http://www.securityfocus.com/bid/100102Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1039004Third Party AdvisoryVDB Entry
- http://www.vmware.com/security/advisories/VMSA-2017-0012.htmlMitigationVendor Advisory
FAQ
What is CVE-2017-4919?
CVE-2017-4919 is a vulnerability with a CVSS score of 9.0 (CRITICAL). VMware vCenter Server 5.5, 6.0, 6.5 allows vSphere users with certain, limited vSphere privileges to use the VIX API to access Guest Operating Systems without the need to authenticate.
How severe is CVE-2017-4919?
CVE-2017-4919 has been rated CRITICAL with a CVSS base score of 9.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2017-4919?
Check the references section above for vendor advisories and patch information. Affected products include: Vmware Vcenter Server.