CVE-2017-4928

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-11-17 · updated 2026-06-17
Weakness: CWE-352

Description

The flash-based vSphere Web Client (6.0 prior to 6.0 U3c and 5.5 prior to 5.5 U3f) i.e. not the new HTML5-based vSphere Client, contains SSRF and CRLF injection issues due to improper neutralization of URLs. An attacker may exploit these issues by sending a POST request with modified headers towards internal services leading to information disclosure.

Affected products

VMware vCenter Server: 5.5, 5.5-1, 5.5-1a, 5.5-1b, 5.5-1c, 5.5-2 (+21)
VMware vSphere Web Client: from 6.0 prior through 6.0 U3c; from 5.5 prior through 5.5 U3f

References

http://www.securityfocus.com/bid/101785
http://www.securitytracker.com/id/1039759
https://www.vmware.com/security/advisories/VMSA-2017-0017.html
http://www.securityfocus.com/bid/101785
http://www.securitytracker.com/id/1039759
https://www.vmware.com/security/advisories/VMSA-2017-0017.html

Get alerted when CVE-2017-4928 or the next vulnerability affects your stack