CVE-2017-4917

VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x locally stores vCenter Server credentials using reversible encryption. This issue may allow plaintext credentials to be obtained.

Score

CVSS 3.0 9.8 Critical

Status

Modified - security@vmware.com

Published

2017-06-07

Last modified

2024-08-05

Weaknesses

CWE-327

Affected products

• Vsphere Data Protection (Vmware)
• Vsphere Data Protection Vdp (Vmware)

References

• http://www.securityfocus.com/bid/98936
• http://www.securitytracker.com/id/1038617
• http://www.vmware.com/security/advisories/VMSA-2017-0010.html