High severity · published Dec 29, 2016
CVE-2016-7462
The Suite REST API in VMware vRealize Operations (aka vROps) 6.x before 6.4.0 allows remote authenticated users to write arbitrary content to files or rename files via a crafted…
8.5
CVSS
2%
EPSS
No
On KEV
Description
The Suite REST API in VMware vRealize Operations (aka vROps) 6.x before 6.4.0 allows remote authenticated users to write arbitrary content to files or rename files via a crafted DiskFileItem in a relay-request payload that is mishandled during deserialization.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VO
Vrealize Operations · Vmware
6.0.0; 6.1.0; 6.2.0a; 6.2.1; 6.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-7462
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-7462
www.securityfocus.com
http://www.securityfocus.com/bid/94351
www.securitytracker.com
http://www.securitytracker.com/id/1037297
Vendor Advisory
http://www.vmware.com/security/advisories/VMSA-2016-0020.html
Technical Description
https://www.tenable.com/security/research/tra-2016-34
More from Vrealize Operations
10.0
CVE-2016-7457
VMware vRealize Operations (aka vROps) 6.x before 6.4.0 allows remote authenticated users to gain privileges, or halt and remove virtual machines, via unspecified vectors
9.8
CVE-2020-3943
vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) uses a JMX RMI service which is not securely configured
8.8
CVE-2023-20877
VMware Aria Operations contains a privilege escalation vulnerability
8.8
CVE-2023-20856
VMware vRealize Operations (vROps) contains a CSRF bypass vulnerability
8.8
CVE-2022-31673
VMware vRealize Operations contains an information disclosure vulnerability