Vulnerability-Lookup

CVE-2017-4914 (GCVE-0-2017-4914)

Vulnerability from cvelistv5 – Published: 2017-06-07 17:00 – Updated: 2024-08-05 14:47

Summary

VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue. Exploitation of this issue may allow a remote attacker to execute commands on the appliance.

Severity

9.8 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

Remote Command Execution

Assigner

vmware mitre root Scorecard

References

4 references

URL	Tags
http://www.securityfocus.com/bid/98939	vdb-entryx_refsource_BID
https://www.exploit-db.com/exploits/42152/	exploitx_refsource_EXPLOIT-DB
http://www.vmware.com/security/advisories/VMSA-20…	x_refsource_CONFIRM
http://www.securitytracker.com/id/1038617	vdb-entryx_refsource_SECTRACK

Impacted products

1 product

Vendor	Product	Version	CPE status
VMware	vSphere Data Protection (VDP)	Affected: 6.1.x Affected: 6.0.x Affected: 5.8.x Affected: 5.5.x	guessed

Date Public

2017-06-06 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T14:47:43.209Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "98939",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/98939"
          },
          {
            "name": "42152",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/42152/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.vmware.com/security/advisories/VMSA-2017-0010.html"
          },
          {
            "name": "1038617",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1038617"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vSphere Data Protection (VDP)",
          "vendor": "VMware",
          "versions": [
            {
              "status": "affected",
              "version": "6.1.x"
            },
            {
              "status": "affected",
              "version": "6.0.x"
            },
            {
              "status": "affected",
              "version": "5.8.x"
            },
            {
              "status": "affected",
              "version": "5.5.x"
            }
          ]
        }
      ],
      "datePublic": "2017-06-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue. Exploitation of this issue may allow a remote attacker to execute commands on the appliance."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Remote Command Execution",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-12T09:57:01.000Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "name": "98939",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/98939"
        },
        {
          "name": "42152",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/42152/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.vmware.com/security/advisories/VMSA-2017-0010.html"
        },
        {
          "name": "1038617",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1038617"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@vmware.com",
          "ID": "CVE-2017-4914",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "vSphere Data Protection (VDP)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "6.1.x"
                          },
                          {
                            "version_value": "6.0.x"
                          },
                          {
                            "version_value": "5.8.x"
                          },
                          {
                            "version_value": "5.5.x"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "VMware"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue. Exploitation of this issue may allow a remote attacker to execute commands on the appliance."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Remote Command Execution"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "98939",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/98939"
            },
            {
              "name": "42152",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/42152/"
            },
            {
              "name": "http://www.vmware.com/security/advisories/VMSA-2017-0010.html",
              "refsource": "CONFIRM",
              "url": "http://www.vmware.com/security/advisories/VMSA-2017-0010.html"
            },
            {
              "name": "1038617",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1038617"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2017-4914",
    "datePublished": "2017-06-07T17:00:00.000Z",
    "dateReserved": "2016-12-26T00:00:00.000Z",
    "dateUpdated": "2024-08-05T14:47:43.209Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2017-4914",
      "date": "2026-10-07",
      "epss": "0.08833",
      "percentile": "0.95073"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.1:*:*:*:*:*:*:*",
                  "matchCriteriaId": "AC2725FD-0BEF-442B-A2D6-83C1BF3644E5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.5:*:*:*:*:*:*:*",
                  "matchCriteriaId": "785AF64D-7D94-49C2-9590-54C709736136",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.6:*:*:*:*:*:*:*",
                  "matchCriteriaId": "3A8679C1-4ACA-4E6C-90FC-C906C6E70AA4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.7:*:*:*:*:*:*:*",
                  "matchCriteriaId": "43F7F343-0BC4-4142-8FEF-3F52A1AD6EEE",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.8:*:*:*:*:*:*:*",
                  "matchCriteriaId": "5455D69B-3439-4345-956F-EB7F80D8AFED",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.9:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E49E8B4D-B20A-42F5-BDAF-A53459E980BA",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.10:*:*:*:*:*:*:*",
                  "matchCriteriaId": "2ABC25F6-3793-475A-A4AA-B52CA0B6AFC7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.11:*:*:*:*:*:*:*",
                  "matchCriteriaId": "AE870CC9-2B3B-4C80-AB92-A0F1CB869BA8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.8.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "333C262E-9FB0-4A7B-8269-D58FA1371679",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.8.1:*:*:*:*:*:*:*",
                  "matchCriteriaId": "FCB9A697-E4F7-4A8E-BFCC-ACC33EEFF33C",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.8.2:*:*:*:*:*:*:*",
                  "matchCriteriaId": "2438674B-8D7C-433A-A7F1-E97A546DC3D8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.8.3:*:*:*:*:*:*:*",
                  "matchCriteriaId": "05828BD4-C209-4278-80DF-632274B2ECBD",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.8.4:*:*:*:*:*:*:*",
                  "matchCriteriaId": "59A07628-0466-4E91-B016-4C6B311C479E",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:6.0.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "FBA48F5F-3B72-427E-9C9A-E5C3EC03A5F8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:6.0.1:*:*:*:*:*:*:*",
                  "matchCriteriaId": "5AF32F55-AE25-4F52-B043-1C2623344F1A",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:6.0.2:*:*:*:*:*:*:*",
                  "matchCriteriaId": "B8FEBFF6-CEF2-4A8E-BA29-3F383D6DF436",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:6.0.3:*:*:*:*:*:*:*",
                  "matchCriteriaId": "BEC123DA-FBC3-4075-B4C0-A5295A6965A1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:6.0.4:*:*:*:*:*:*:*",
                  "matchCriteriaId": "4D8E9053-F846-48A5-93D7-35D0665D4038",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:6.1.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "0D7E39A9-BE37-4848-BAD2-7F97D04F0D7C",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:6.1.1:*:*:*:*:*:*:*",
                  "matchCriteriaId": "7A908399-8C17-46B6-B554-77F588C2BF42",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:6.1.2:*:*:*:*:*:*:*",
                  "matchCriteriaId": "FC8AFC55-915D-46AC-80DA-E100F4CFFD64",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:6.1.3:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E2B9A334-69EB-4E88-A446-18A1B0C669B2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue. Exploitation of this issue may allow a remote attacker to execute commands on the appliance."
        },
        {
          "lang": "es",
          "value": "VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, y 5.5.x contiene un problema de deserializaci\u00f3n que permitir\u00eda a un atacante remoto ejecutar comandos en el aparato."
        }
      ],
      "id": "CVE-2017-4914",
      "lastModified": "2024-11-21T03:26:39.487",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "HIGH",
            "cvssData": {
              "accessComplexity": "LOW",
              "accessVector": "NETWORK",
              "authentication": "NONE",
              "availabilityImpact": "PARTIAL",
              "baseScore": 7.5,
              "confidentialityImpact": "PARTIAL",
              "integrityImpact": "PARTIAL",
              "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
              "version": "2.0"
            },
            "exploitabilityScore": 10.0,
            "impactScore": 6.4,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": false
          }
        ],
        "cvssMetricV30": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.0"
            },
            "exploitabilityScore": 3.9,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2017-06-07T17:29:00.867",
      "references": [
        {
          "source": "security@vmware.com",
          "tags": [
            "Third Party Advisory",
            "VDB Entry"
          ],
          "url": "http://www.securityfocus.com/bid/98939"
        },
        {
          "source": "security@vmware.com",
          "url": "http://www.securitytracker.com/id/1038617"
        },
        {
          "source": "security@vmware.com",
          "tags": [
            "Patch",
            "Vendor Advisory"
          ],
          "url": "http://www.vmware.com/security/advisories/VMSA-2017-0010.html"
        },
        {
          "source": "security@vmware.com",
          "url": "https://www.exploit-db.com/exploits/42152/"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory",
            "VDB Entry"
          ],
          "url": "http://www.securityfocus.com/bid/98939"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.securitytracker.com/id/1038617"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch",
            "Vendor Advisory"
          ],
          "url": "http://www.vmware.com/security/advisories/VMSA-2017-0010.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://www.exploit-db.com/exploits/42152/"
        }
      ],
      "sourceIdentifier": "security@vmware.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-502"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AC2725FD-0BEF-442B-A2D6-83C1BF3644E5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.5:*:*:*:*:*:*:*",
                    "matchCriteriaId": "785AF64D-7D94-49C2-9590-54C709736136",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.6:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3A8679C1-4ACA-4E6C-90FC-C906C6E70AA4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.7:*:*:*:*:*:*:*",
                    "matchCriteriaId": "43F7F343-0BC4-4142-8FEF-3F52A1AD6EEE",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.8:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5455D69B-3439-4345-956F-EB7F80D8AFED",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.9:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E49E8B4D-B20A-42F5-BDAF-A53459E980BA",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.10:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2ABC25F6-3793-475A-A4AA-B52CA0B6AFC7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.11:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AE870CC9-2B3B-4C80-AB92-A0F1CB869BA8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.8.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "333C262E-9FB0-4A7B-8269-D58FA1371679",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.8.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FCB9A697-E4F7-4A8E-BFCC-ACC33EEFF33C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.8.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2438674B-8D7C-433A-A7F1-E97A546DC3D8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.8.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "05828BD4-C209-4278-80DF-632274B2ECBD",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.8.4:*:*:*:*:*:*:*",
                    "matchCriteriaId": "59A07628-0466-4E91-B016-4C6B311C479E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:6.0.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FBA48F5F-3B72-427E-9C9A-E5C3EC03A5F8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:6.0.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5AF32F55-AE25-4F52-B043-1C2623344F1A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:6.0.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B8FEBFF6-CEF2-4A8E-BA29-3F383D6DF436",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:6.0.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BEC123DA-FBC3-4075-B4C0-A5295A6965A1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:6.0.4:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4D8E9053-F846-48A5-93D7-35D0665D4038",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:6.1.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0D7E39A9-BE37-4848-BAD2-7F97D04F0D7C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:6.1.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7A908399-8C17-46B6-B554-77F588C2BF42",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:6.1.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FC8AFC55-915D-46AC-80DA-E100F4CFFD64",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:6.1.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E2B9A334-69EB-4E88-A446-18A1B0C669B2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue. Exploitation of this issue may allow a remote attacker to execute commands on the appliance."
          },
          {
            "lang": "es",
            "value": "VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, y 5.5.x contiene un problema de deserializaci\u00f3n que permitir\u00eda a un atacante remoto ejecutar comandos en el aparato."
          }
        ],
        "id": "CVE-2017-4914",
        "lastModified": "2026-05-13T00:24:29.033",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "HIGH",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 7.5,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 10.0,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV30": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.0"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2017-06-07T17:29:00.867",
        "references": [
          {
            "source": "security@vmware.com",
            "tags": [
              "Third Party Advisory",
              "VDB Entry"
            ],
            "url": "http://www.securityfocus.com/bid/98939"
          },
          {
            "source": "security@vmware.com",
            "url": "http://www.securitytracker.com/id/1038617"
          },
          {
            "source": "security@vmware.com",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "http://www.vmware.com/security/advisories/VMSA-2017-0010.html"
          },
          {
            "source": "security@vmware.com",
            "url": "https://www.exploit-db.com/exploits/42152/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory",
              "VDB Entry"
            ],
            "url": "http://www.securityfocus.com/bid/98939"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securitytracker.com/id/1038617"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "http://www.vmware.com/security/advisories/VMSA-2017-0010.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://www.exploit-db.com/exploits/42152/"
          }
        ],
        "sourceIdentifier": "security@vmware.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-502"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

CERTFR-2017-AVI-170

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été corrigées dans VMware vSphere Data Protection (VDP). Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	VMware	N/A	VDP versions 6.1.x sans le correctif de sécurité 6.1.4
	VMware	N/A	VDP versions antérieures à 6.0.5

References

Title

Publication Time

CERTFR-2017-AVI-170

Vulnerability from certfr_avis - Published: - Updated:

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	VMware	N/A	VDP versions 6.1.x sans le correctif de sécurité 6.1.4
	VMware	N/A	VDP versions antérieures à 6.0.5

References

Title

Publication Time

BDU:2017-02001 (CVE-2017-4914)

Vulnerability from fstec – Published: 2017-09-08 – Updated: 2021-03-23 – View on bdu.fstec.ru Fixed

Title

Уязвимость средства резервного копирования виртуальных машин vSphere Data Protection, вызванная проблемами десериализации, позволяющая нарушителю выполнить команды на устройстве

Summary

Уязвимость средства резервного копирования виртуальных машин vSphere Data Protection вызвана проблемами десериализации. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнить команды на устройстве

Severity

7.5 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:P/I:P/A:P

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Data structure manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-502 - Восстановление в памяти недостоверных данных

Aliases

CVE-2017-4914, VMSA-2017-0010, BID, ID:98939

References

2 references

URL
http://www.securityfocus.com/bid/98939
http://www.vmware.com/security/advisories/VMSA-2017-0010.html

Impacted products

1 product from 1 vendor

Vendors

Broadcom Inc.

Products

vSphere Data Protection

Versions

6.0.2 (vSphere Data Protection), 6.1.1 (vSphere Data Protection), 6.0.3 (vSphere Data Protection), 6.1.2 (vSphere Data Protection), 6.0.4 (vSphere Data Protection), 6.1.3 (vSphere Data Protection), 6.0.0 (vSphere Data Protection), 6.0.1 (vSphere Data Protection), 6.1.0 (vSphere Data Protection), 5.8.1 (vSphere Data Protection), 5.5.5 (vSphere Data Protection), 5.5.11 (vSphere Data Protection), 5.8.2 (vSphere Data Protection), 5.5.10 (vSphere Data Protection), 5.8.0 (vSphere Data Protection), 5.5.8 (vSphere Data Protection), 5.5.9 (vSphere Data Protection), 5.5.6 (vSphere Data Protection), 5.8.3 (vSphere Data Protection), 5.5.7 (vSphere Data Protection), 5.8.4 (vSphere Data Protection), 5.5.1 (vSphere Data Protection)

Product types

Virtualization software

Mitigations

Использование рекомендаций разработчика: http://www.vmware.com/security/advisories/VMSA-2017-0010.html

Credits

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
  "CVSS 3.0": null,
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Broadcom Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "6.0.2 (vSphere Data Protection), 6.1.1 (vSphere Data Protection), 6.0.3 (vSphere Data Protection), 6.1.2 (vSphere Data Protection), 6.0.4 (vSphere Data Protection), 6.1.3 (vSphere Data Protection), 6.0.0 (vSphere Data Protection), 6.0.1 (vSphere Data Protection), 6.1.0 (vSphere Data Protection), 5.8.1 (vSphere Data Protection), 5.5.5 (vSphere Data Protection), 5.5.11 (vSphere Data Protection), 5.8.2 (vSphere Data Protection), 5.5.10 (vSphere Data Protection), 5.8.0 (vSphere Data Protection), 5.5.8 (vSphere Data Protection), 5.5.9 (vSphere Data Protection), 5.5.6 (vSphere Data Protection), 5.8.3 (vSphere Data Protection), 5.5.7 (vSphere Data Protection), 5.8.4 (vSphere Data Protection), 5.5.1 (vSphere Data Protection)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430: http://www.vmware.com/security/advisories/VMSA-2017-0010.html",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "06.06.2017",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "23.03.2021",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "08.09.2017",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2017-02001",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2017-4914, VMSA-2017-0010, BID ID:98939",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "vSphere Data Protection",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0433\u043e \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d vSphere Data Protection, \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c\u0438 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0412\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u043d\u0435\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 (CWE-502)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0433\u043e \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d vSphere Data Protection \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c\u0438 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": "-",
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "http://www.securityfocus.com/bid/98939\nhttp://www.vmware.com/security/advisories/VMSA-2017-0010.html",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u041e \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438/\u041f\u041e \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-502",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,5)"
}

CNVD-2017-09187

Vulnerability from cnvd - Published: 2017-06-12

Title

VMware vSphere Data Protection Java反序列化漏洞

Description

VMware vSphere Data Protection（VDP）美国威睿（VMware）公司的一套基于磁盘的备份和恢复解决方案。该方案通过与VMware vCenter Server（服务器和虚拟化管理软件）集成，可用来对备份作业执行集中式管理，同时将备份文件存储在经过重复数据消除的目标存储位置。 VMware VDP中存在Java反序列化漏洞。攻击者可利用漏洞在受影响的应用程序的上下文中执行任意代码，或造成程序拒绝服务。

Severity

高

Patch Name

VMware vSphere Data Protection Java反序列化漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： http://www.vmware.com/security/advisories/VMSA-2017-0010.html

Reference

http://securitytracker.com/id/1038617

Impacted products

Name
['VMware vSphere Data Protection 5.5.x', 'VMware vSphere Data Protection 5.8.x', 'VMware vSphere Data Protection 6.0.x', 'VMware vSphere Data Protection 6.1.x']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "98939"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-4914",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-4914"
    }
  },
  "description": "VMware vSphere Data Protection\uff08VDP\uff09\u7f8e\u56fd\u5a01\u777f\uff08VMware\uff09\u516c\u53f8\u7684\u4e00\u5957\u57fa\u4e8e\u78c1\u76d8\u7684\u5907\u4efd\u548c\u6062\u590d\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u65b9\u6848\u901a\u8fc7\u4e0eVMware vCenter Server\uff08\u670d\u52a1\u5668\u548c\u865a\u62df\u5316\u7ba1\u7406\u8f6f\u4ef6\uff09\u96c6\u6210\uff0c\u53ef\u7528\u6765\u5bf9\u5907\u4efd\u4f5c\u4e1a\u6267\u884c\u96c6\u4e2d\u5f0f\u7ba1\u7406\uff0c\u540c\u65f6\u5c06\u5907\u4efd\u6587\u4ef6\u5b58\u50a8\u5728\u7ecf\u8fc7\u91cd\u590d\u6570\u636e\u6d88\u9664\u7684\u76ee\u6807\u5b58\u50a8\u4f4d\u7f6e\u3002\r\n\r\nVMware VDP\u4e2d\u5b58\u5728Java\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u5728\u53d7\u5f71\u54cd\u7684\u5e94\u7528\u7a0b\u5e8f\u7684\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u4efb\u610f\u4ee3\u7801\uff0c\u6216\u9020\u6210\u7a0b\u5e8f\u62d2\u7edd\u670d\u52a1\u3002",
  "discovererName": "Tim Roberts, Arthur Chilipweli, and Kelly Correll from NTT Security",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttp://www.vmware.com/security/advisories/VMSA-2017-0010.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-09187",
  "openTime": "2017-06-12",
  "patchDescription": "VMware vSphere Data Protection\uff08VDP\uff09\u7f8e\u56fd\u5a01\u777f\uff08VMware\uff09\u516c\u53f8\u7684\u4e00\u5957\u57fa\u4e8e\u78c1\u76d8\u7684\u5907\u4efd\u548c\u6062\u590d\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u65b9\u6848\u901a\u8fc7\u4e0eVMware vCenter Server\uff08\u670d\u52a1\u5668\u548c\u865a\u62df\u5316\u7ba1\u7406\u8f6f\u4ef6\uff09\u96c6\u6210\uff0c\u53ef\u7528\u6765\u5bf9\u5907\u4efd\u4f5c\u4e1a\u6267\u884c\u96c6\u4e2d\u5f0f\u7ba1\u7406\uff0c\u540c\u65f6\u5c06\u5907\u4efd\u6587\u4ef6\u5b58\u50a8\u5728\u7ecf\u8fc7\u91cd\u590d\u6570\u636e\u6d88\u9664\u7684\u76ee\u6807\u5b58\u50a8\u4f4d\u7f6e\u3002\r\n\r\nVMware VDP\u4e2d\u5b58\u5728Java\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u5728\u53d7\u5f71\u54cd\u7684\u5e94\u7528\u7a0b\u5e8f\u7684\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u4efb\u610f\u4ee3\u7801\uff0c\u6216\u9020\u6210\u7a0b\u5e8f\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "VMware vSphere Data Protection Java\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "VMware vSphere Data Protection 5.5.x",
      "VMware vSphere Data Protection 5.8.x",
      "VMware vSphere Data Protection 6.0.x",
      "VMware vSphere Data Protection 6.1.x"
    ]
  },
  "referenceLink": "http://securitytracker.com/id/1038617",
  "serverity": "\u9ad8",
  "submitTime": "2017-06-07",
  "title": "VMware vSphere Data Protection Java\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e"
}

FKIE_CVE-2017-4914

Vulnerability from fkie_nvd - Published: 2017-06-07 17:29 - Updated: 2026-06-17 01:19

Severity

9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue. Exploitation of this issue may allow a remote attacker to execute commands on the appliance.

References

URL	Tags
security@vmware.com	http://www.securityfocus.com/bid/98939	Third Party Advisory, VDB Entry
security@vmware.com	http://www.securitytracker.com/id/1038617
security@vmware.com	http://www.vmware.com/security/advisories/VMSA-2017-0010.html	Patch, Vendor Advisory
security@vmware.com	https://www.exploit-db.com/exploits/42152/
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/98939	Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	http://www.securitytracker.com/id/1038617
af854a3a-2127-422b-91ae-364da2661108	http://www.vmware.com/security/advisories/VMSA-2017-0010.html	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.exploit-db.com/exploits/42152/

Impacted products

Vendor	Product	Version
vmware	vsphere_data_protection	5.5.1
vmware	vsphere_data_protection	5.5.5
vmware	vsphere_data_protection	5.5.6
vmware	vsphere_data_protection	5.5.7
vmware	vsphere_data_protection	5.5.8
vmware	vsphere_data_protection	5.5.9
vmware	vsphere_data_protection	5.5.10
vmware	vsphere_data_protection	5.5.11
vmware	vsphere_data_protection	5.8.0
vmware	vsphere_data_protection	5.8.1
vmware	vsphere_data_protection	5.8.2
vmware	vsphere_data_protection	5.8.3
vmware	vsphere_data_protection	5.8.4
vmware	vsphere_data_protection	6.0.0
vmware	vsphere_data_protection	6.0.1
vmware	vsphere_data_protection	6.0.2
vmware	vsphere_data_protection	6.0.3
vmware	vsphere_data_protection	6.0.4
vmware	vsphere_data_protection	6.1.0
vmware	vsphere_data_protection	6.1.1
vmware	vsphere_data_protection	6.1.2
vmware	vsphere_data_protection	6.1.3

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "vSphere Data Protection (VDP)",
          "vendor": "VMware",
          "versions": [
            {
              "status": "affected",
              "version": "6.1.x"
            },
            {
              "status": "affected",
              "version": "6.0.x"
            },
            {
              "status": "affected",
              "version": "5.8.x"
            },
            {
              "status": "affected",
              "version": "5.5.x"
            }
          ]
        }
      ],
      "source": "security@vmware.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "AC2725FD-0BEF-442B-A2D6-83C1BF3644E5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "785AF64D-7D94-49C2-9590-54C709736136",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "3A8679C1-4ACA-4E6C-90FC-C906C6E70AA4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "43F7F343-0BC4-4142-8FEF-3F52A1AD6EEE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "5455D69B-3439-4345-956F-EB7F80D8AFED",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "E49E8B4D-B20A-42F5-BDAF-A53459E980BA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "2ABC25F6-3793-475A-A4AA-B52CA0B6AFC7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "AE870CC9-2B3B-4C80-AB92-A0F1CB869BA8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "333C262E-9FB0-4A7B-8269-D58FA1371679",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.8.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "FCB9A697-E4F7-4A8E-BFCC-ACC33EEFF33C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.8.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "2438674B-8D7C-433A-A7F1-E97A546DC3D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.8.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "05828BD4-C209-4278-80DF-632274B2ECBD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:5.8.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "59A07628-0466-4E91-B016-4C6B311C479E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:6.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "FBA48F5F-3B72-427E-9C9A-E5C3EC03A5F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:6.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "5AF32F55-AE25-4F52-B043-1C2623344F1A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:6.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "B8FEBFF6-CEF2-4A8E-BA29-3F383D6DF436",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:6.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "BEC123DA-FBC3-4075-B4C0-A5295A6965A1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:6.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D8E9053-F846-48A5-93D7-35D0665D4038",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:6.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D7E39A9-BE37-4848-BAD2-7F97D04F0D7C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:6.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7A908399-8C17-46B6-B554-77F588C2BF42",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:6.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "FC8AFC55-915D-46AC-80DA-E100F4CFFD64",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:vsphere_data_protection:6.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "E2B9A334-69EB-4E88-A446-18A1B0C669B2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue. Exploitation of this issue may allow a remote attacker to execute commands on the appliance."
    },
    {
      "lang": "es",
      "value": "VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, y 5.5.x contiene un problema de deserializaci\u00f3n que permitir\u00eda a un atacante remoto ejecutar comandos en el aparato."
    }
  ],
  "id": "CVE-2017-4914",
  "lastModified": "2026-06-17T01:19:33.167",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-06-07T17:29:00.867",
  "references": [
    {
      "source": "security@vmware.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/98939"
    },
    {
      "source": "security@vmware.com",
      "url": "http://www.securitytracker.com/id/1038617"
    },
    {
      "source": "security@vmware.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.vmware.com/security/advisories/VMSA-2017-0010.html"
    },
    {
      "source": "security@vmware.com",
      "url": "https://www.exploit-db.com/exploits/42152/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/98939"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id/1038617"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.vmware.com/security/advisories/VMSA-2017-0010.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.exploit-db.com/exploits/42152/"
    }
  ],
  "sourceIdentifier": "security@vmware.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-8Q56-88XV-7QX3

Vulnerability from github – Published: 2022-05-17 02:14 – Updated: 2025-04-20 03:38

Details

VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue. Exploitation of this issue may allow a remote attacker to execute commands on the appliance.

Severity

9.8 (Critical)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2017-4914"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-06-07T17:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue. Exploitation of this issue may allow a remote attacker to execute commands on the appliance.",
  "id": "GHSA-8q56-88xv-7qx3",
  "modified": "2025-04-20T03:38:36Z",
  "published": "2022-05-17T02:14:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-4914"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/42152"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/98939"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1038617"
    },
    {
      "type": "WEB",
      "url": "http://www.vmware.com/security/advisories/VMSA-2017-0010.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2017-4914

Vulnerability from gsd - Updated: 2023-12-13 01:21

Details

VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue. Exploitation of this issue may allow a remote attacker to execute commands on the appliance.

Aliases

CVE-2017-4914

Aliases

CVE-2017-4914

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2017-4914",
    "description": "VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue. Exploitation of this issue may allow a remote attacker to execute commands on the appliance.",
    "id": "GSD-2017-4914",
    "references": [
      "https://packetstormsecurity.com/files/cve/CVE-2017-4914"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2017-4914"
      ],
      "details": "VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue. Exploitation of this issue may allow a remote attacker to execute commands on the appliance.",
      "id": "GSD-2017-4914",
      "modified": "2023-12-13T01:21:02.929574Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@vmware.com",
        "ID": "CVE-2017-4914",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "vSphere Data Protection (VDP)",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "6.1.x"
                        },
                        {
                          "version_value": "6.0.x"
                        },
                        {
                          "version_value": "5.8.x"
                        },
                        {
                          "version_value": "5.5.x"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "VMware"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue. Exploitation of this issue may allow a remote attacker to execute commands on the appliance."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Remote Command Execution"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "98939",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/98939"
          },
          {
            "name": "42152",
            "refsource": "EXPLOIT-DB",
            "url": "https://www.exploit-db.com/exploits/42152/"
          },
          {
            "name": "http://www.vmware.com/security/advisories/VMSA-2017-0010.html",
            "refsource": "CONFIRM",
            "url": "http://www.vmware.com/security/advisories/VMSA-2017-0010.html"
          },
          {
            "name": "1038617",
            "refsource": "SECTRACK",
            "url": "http://www.securitytracker.com/id/1038617"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:vmware:vsphere_data_protection:5.8.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:vmware:vsphere_data_protection:5.8.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:vmware:vsphere_data_protection:6.1.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:vmware:vsphere_data_protection:6.1.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.11:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:vmware:vsphere_data_protection:6.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:vmware:vsphere_data_protection:6.0.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:vmware:vsphere_data_protection:6.0.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:vmware:vsphere_data_protection:5.8.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:vmware:vsphere_data_protection:6.0.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:vmware:vsphere_data_protection:6.1.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:vmware:vsphere_data_protection:5.5.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:vmware:vsphere_data_protection:5.8.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:vmware:vsphere_data_protection:5.8.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:vmware:vsphere_data_protection:6.0.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:vmware:vsphere_data_protection:6.1.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security@vmware.com",
          "ID": "CVE-2017-4914"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue. Exploitation of this issue may allow a remote attacker to execute commands on the appliance."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-502"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.vmware.com/security/advisories/VMSA-2017-0010.html",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://www.vmware.com/security/advisories/VMSA-2017-0010.html"
            },
            {
              "name": "98939",
              "refsource": "BID",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://www.securityfocus.com/bid/98939"
            },
            {
              "name": "1038617",
              "refsource": "SECTRACK",
              "tags": [],
              "url": "http://www.securitytracker.com/id/1038617"
            },
            {
              "name": "42152",
              "refsource": "EXPLOIT-DB",
              "tags": [],
              "url": "https://www.exploit-db.com/exploits/42152/"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2017-08-13T01:29Z",
      "publishedDate": "2017-06-07T17:29Z"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2017-4914 (GCVE-0-2017-4914)

CERTFR-2017-AVI-170

Solution

CERTFR-2017-AVI-170

Solution

BDU:2017-02001 (CVE-2017-4914)

CNVD-2017-09187

FKIE_CVE-2017-4914

GHSA-8Q56-88XV-7QX3

GSD-2017-4914

Tags

Sightings

Nomenclature

Related by attack behaviour