VMware vSphere Client XXE Injection Information Disclosure (VMSA-2016-0022)
Medium Nessus Plugin ID 95657
SynopsisThe remote host has a virtualization client application installed that is affected by an information disclosure vulnerability.
DescriptionThe version of vSphere Client installed on the remote Windows host is affected by an information disclosure vulnerability due to an incorrectly configured XML parser accepting XML external entities (XXE) from an untrusted source. An unauthenticated, remote attacker can exploit this issue to disclose arbitrary files by convincing a user to connect to a malicious instance of a vCenter Server or ESXi host containing specially crafted XML data.
SolutionUpgrade to vSphere Client version 5.5 Update 3e / 6.0 Update 2a or later.