« Volver al listado

CVE-2016-7462

Estado: ModificadaAlta (8.5)—

The Suite REST API in VMware vRealize Operations (aka vROps) 6.x before 6.4.0 allows remote authenticated users to write arbitrary content to files or rename files via a crafted DiskFileItem in a relay-request payload that is mishandled during deserialization.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Vmware — Vrealize Operations

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-7462",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 7.8,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 8.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2016-12-29T09:59:00.727",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/94351",
      "source": "security@vmware.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1037297",
      "source": "security@vmware.com"
    },
    {
      "url": "http://www.vmware.com/security/advisories/VMSA-2016-0020.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "https://www.tenable.com/security/research/tra-2016-34",
      "tags": [
        "Technical Description",
        "Third Party Advisory"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/94351",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1037297",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vmware.com/security/advisories/VMSA-2016-0020.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.tenable.com/security/research/tra-2016-34",
      "tags": [
        "Technical Description",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        },
        {
          "lang": "en",
          "value": "CWE-749"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Suite REST API in VMware vRealize Operations (aka vROps) 6.x before 6.4.0 allows remote authenticated users to write arbitrary content to files or rename files via a crafted DiskFileItem in a relay-request payload that is mishandled during deserialization."
    },
    {
      "lang": "es",
      "value": "El Suite REST API en VMware vRealize Operations (también conocido como vROps) 6.x en versiones anteriores a 6.4.0 permite a usuarios remotos autenticados escribir contenido arbitrario en archivos o renombrar archivos a través de un DiskFileItem manipulado en una petición de trasmisión de carga útil que no es manejada correctamente durante la deserialización."
    }
  ],
  "lastModified": "2026-06-17T00:53:06.677",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:vrealize_operations:6.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7527E0FF-EDEE-45B9-859C-59CBEC0519E3"
            },
            {
              "criteria": "cpe:2.3:a:vmware:vrealize_operations:6.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "298BD34D-0F06-44F7-AD8B-424F266AE0DE"
            },
            {
              "criteria": "cpe:2.3:a:vmware:vrealize_operations:6.2.0a:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DC0394A5-03BA-43ED-AA76-8E798279288C"
            },
            {
              "criteria": "cpe:2.3:a:vmware:vrealize_operations:6.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5D166F44-FCB2-481A-A85B-DC581A72043A"
            },
            {
              "criteria": "cpe:2.3:a:vmware:vrealize_operations:6.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C3C8FA12-B06F-4413-A3C9-DA15B5391D3E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@vmware.com"
}