CVE-2016-7460

Published: Dec 29, 2016Modified: May 6, 2026

9.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Exploitability: 3.9 / Impact: 5.2

Source: NVD

Description

The Single Sign-On feature in VMware vCenter Server 5.5 before U3e and 6.0 before U2a and vRealize Automation 6.x before 6.2.5 allows remote attackers to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Affected (11)

Products: Vmware: Vrealize Automation

Vmware

1 product

Vrealize Automation

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Vmware Vrealize Automation	Version 6.0.0
Vmware Vrealize Automation	Version 6.0.1.1
Vmware Vrealize Automation	Version 6.0.1.2
Vmware Vrealize Automation	Version 6.0.1
Vmware Vrealize Automation	Version 6.1.0
Vmware Vrealize Automation	Version 6.1.1
Vmware Vrealize Automation	Version 6.2.0
Vmware Vrealize Automation	Version 6.2.1
Vmware Vrealize Automation	Version 6.2.2
Vmware Vrealize Automation	Version 6.2.3
Vmware Vrealize Automation	Version 6.2.4