| Vulnerability Name: | CVE-2016-7463 (CCN-119911) | ||||||||||||
| Assigned: | 2016-12-20 | ||||||||||||
| Published: | 2016-12-20 | ||||||||||||
| Updated: | 2016-12-31 | ||||||||||||
| Summary: | Cross-site scripting (XSS) vulnerability in the Host Client in VMware vSphere Hypervisor (aka ESXi) 5.5 and 6.0 allows remote authenticated users to inject arbitrary web script or HTML via a crafted VM. | ||||||||||||
| CVSS v3 Severity: | 5.4 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) 5.2 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:H/RL:O/RC:C)
5.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:H/RL:O/RC:C)
| ||||||||||||
| CVSS v2 Severity: | 3.5 Low (CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
| ||||||||||||
| Vulnerability Type: | CWE-79 | ||||||||||||
| Vulnerability Consequences: | Cross-Site Scripting | ||||||||||||
| References: | Source: MITRE Type: CNA CVE-2016-7463 Source: CCN Type: Full Disclosure mailing list, Tue, 20 Dec 2016 14:46:18 +0000 NEW VMSA-2016-0023 VMware ESXi updates address a cross-site scripting issue Source: CCN Type: SECTRACK ID: 1037501 VMware ESXi Input Validation Flaw in Host Client Lets Remote Users Conduct Cross-Site Scripting Attacks Source: BID Type: UNKNOWN 94998 Source: CCN Type: BID-94998 VMware ESXi CVE-2016-7463 HTML Injection Vulnerability Source: SECTRACK Type: UNKNOWN 1037501 Source: CCN Type: VMware Security Advisory VMSA-2016-0023 VMware ESXi updates address a cross-site scripting issue Source: CONFIRM Type: Patch, Vendor Advisory http://www.vmware.com/security/advisories/VMSA-2016-0023.html Source: XF Type: UNKNOWN vmware-cve20167463-xss(119911) | ||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||
| BACK | |||||||||||||