SB2016122001 - Cross-site scripting in VMware ESXi

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2016122001

SB2016122001 - Cross-site scripting in VMware ESXi

Published: December 20, 2016

Security Bulletin ID SB2016122001
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Stored cross-site scripting (CVE-ID: CVE-2016-7463)

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data passed via malicious VM (virtual machine) image. A remote attacker can create a specially crafted VM image, containing XSS exploit, trick the victim into importing the image and permanently store arbitrary HTML and script code, which will be executed in victim’s browser in context of vulnerable website every time the victim visits vulnerable interface.

Successful exploitation of the vulnerability may allow an attacker to gain access to potentially sensitive data.


Remediation

Install update from vendor's website.

References