Executive Summary

TitlevRealize Operations update addresses REST API deserialization vulnerability.
NameVMSA-2016-0020First vendor Publication2016-11-15
VendorVMwareLast vendor Modification2016-11-15
Severity (Vendor) N/ARevisionN/A

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:S/C:N/I:P/A:C)
Cvss Base Score7.5Attack RangeNetwork
Cvss Impact Score7.8Attack ComplexityLow
Cvss Expoit Score8AuthenticationRequires single instance
Calculate full CVSS 2.0 Vectors scores


a. vRealize Operations REST API deserialization vulnerability

vRealize Operations contains a deserialization vulnerability in its REST API implementation. This issue may result in a Denial of Service as it allows for writing of files with arbitrary content and moving existing files into certain folders. The name format of the destination files is predefined and their names cannot be chosen. Overwriting files is not feasible.

VMware would like to thank Jacob Baines of Tenable Network Security for reporting this issue to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2016-7462 to this issue.

Column 5 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.

Original Source

Url : http://www.vmware.com/security/advisories/VMSA-2016-0020.html

CWE : Common Weakness Enumeration

50 %CWE-749Exposed Dangerous Method or Function
50 %CWE-264Permissions, Privileges, and Access Controls

CPE : Common Platform Enumeration


Nessus® Vulnerability Scanner

2016-12-01Name : A cloud operations management application running on the remote web server is...
File : vmware_vrealize_operations_manager_v640_deserialization.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
2016-12-29 21:25:16
  • Multiple Updates
2016-12-29 13:22:01
  • Multiple Updates
2016-12-02 13:24:59
  • Multiple Updates
2016-11-16 09:23:24
  • First insertion