CVE-2017-4922

{"id": "CVE-2017-4922", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2017-08-01T16:29:00.320", "references": [{"url": "http://www.securityfocus.com/bid/100012", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@vmware.com"}, {"url": "http://www.securitytracker.com/id/1039013", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@vmware.com"}, {"url": "https://www.vmware.com/security/advisories/VMSA-2017-0013.html", "tags": ["Patch", "Vendor Advisory"], "source": "security@vmware.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "VMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure issue due to the service startup script using world writable directories as temporary storage for critical information. Successful exploitation of this issue may allow unprivileged host users to access certain critical information when the service gets restarted."}, {"lang": "es", "value": "VMware vCenter Server en su versi\u00f3n 6.5 anterior a la 6.5 U1 tiene un problema de fuga de informaci\u00f3n puesto que el script de inicio del servicio utiliza directorios modificables por cualquier usuario para almacenar temporalmente informaci\u00f3n cr\u00edtica. Si se explota con \u00e9xito esta vulnerabilidad, podr\u00eda permitir que los usuarios host sin privilegios accedan a informaci\u00f3n cr\u00edtica cuando el servicio se reinicie."}], "lastModified": "2017-08-03T16:21:09.473", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vmware:vcenter_server:6.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3D97854C-DE5D-48B4-B5DB-C132E6D4B826"}], "operator": "OR"}]}], "sourceIdentifier": "security@vmware.com"}