CVE-2016-7458

Published: Dec 29, 2016Modified: May 6, 2026

5.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

VMware vSphere Client 5.5 before U3e and 6.0 before U2a allows remote vCenter Server and ESXi instances to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Affected (12)

Products: Vmware: Vsphere Client

Vmware

1 product

Vsphere Client

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Vmware Vsphere Client	Version 5.5
Vmware Vsphere Client	Version 5.5 u1
Vmware Vsphere Client	Version 5.5 u2
Vmware Vsphere Client	Version 5.5 u3a
Vmware Vsphere Client	Version 5.5 u3b
Vmware Vsphere Client	Version 6.0
Vmware Vsphere Client	Version 6.0 2
Vmware Vsphere Client	Version 6.0 2m
Vmware Vsphere Client	Version 6.0 a
Vmware Vsphere Client	Version 6.0 b
Vmware Vsphere Client	Version 6.0 u1
Vmware Vsphere Client	Version 6.0 u1b