UpHeron
All vulnerabilities

Servers and applications

CVE-2017-4928

The flash-based vSphere Web Client (6.0 prior to 6.0 U3c and 5.5 prior to 5.5 U3f) i.e. not the new HTML5-based vSphere Client, contains SSRF and CRLF injection issues due to improper neutralization of URLs. An attacker may exploit these issues by sending a POST request with modified headers towards internal services leading to information disclosure.

Severity
High 7.5
Published
17 Nov 2017
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
1.2% in the next 30 daysHigher than 69% of CVEs. EPSS by FIRST, 11 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
VMware vCenter ServerServers and applications · cpe:a:vmware:vcenter_server
  • Version 6.0-3
  • Version 6.0-2m
  • Version 6.0-2
  • Version 6.0-1
All 27 release lines
  • Version 5.5-1a
  • Version 5.5-1b
  • Version 5.5-1c
  • Version 5.5-2b
  • Version 5.5-3a
  • Version 5.5-3b
  • Version 5.5-b
  • Version 5.5-c
  • Version 5.5
  • Version 5.5-1
  • Version 5.5-2
  • Version 5.5-2d
  • Version 5.5-2e
  • Version 5.5-3
  • Version 5.5-3d
  • Version 5.5-3e
  • Version 6.0-1b
  • Version 6.0-2a
  • Version 6.0-3a
  • Version 6.0-3b
  • Version 6.0-a
  • Version 6.0-b
  • Version 6.0
  • Version 6.0-1
  • Version 6.0-2
  • Version 6.0-2m
  • Version 6.0-3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2017-4928
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2017-4928