CVE Catalog
CVE-2017-4919
CriticalSummary
VMware vCenter Server versions 5.5, 6.0, and 6.5 allow vSphere users with limited privileges to use the VIX API to access Guest Operating Systems without the need for authentication.
Risk Assessment
The possibility of unauthorized access to Guest Operating Systems poses a significant threat to the security of organizational data and infrastructure.
Recommendation
It is recommended to restrict vSphere user privileges and monitor access to the VIX API to minimize risk.
Original NVD description (English source)
VMware vCenter Server 5.5, 6.0, 6.5 allows vSphere users with certain, limited vSphere privileges to use the VIX API to access Guest Operating Systems without the need to authenticate.