CVE-2016-7460

Critical

Published: 29/12/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The Single Sign-On feature in VMware vCenter Server 5.5 before U3e, 6.0 before U2a, and vRealize Automation 6.x before 6.2.5 allows remote attackers to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Risk Assessment

An attacker may gain access to sensitive data or disrupt system operations, potentially leading to serious consequences for the organization.

Recommendation

It is recommended to upgrade to the latest version of VMware vCenter Server and vRealize Automation to mitigate this vulnerability.

Original NVD description (English source)

The Single Sign-On feature in VMware vCenter Server 5.5 before U3e and 6.0 before U2a and vRealize Automation 6.x before 6.2.5 allows remote attackers to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.