VMSA-2016-0003

VMware vRealize Automation and vRealize Business Advanced and Enterprise address Cross-Site Scripting (XSS) issues.

VMware Security Advisory
 
VMware Security Advisory Advisory ID:
  VMSA-2016-0003
VMware Security Advisory Synopsis:
  VMware vRealize Automation and vRealize Business Advanced and Enterprise address Cross-Site Scripting (XSS) issues.
VMware Security Advisory Issue date:
  2016-03-15
VMware Security Advisory Updated on:
  2016-03-15 (Initial Advisory)
VMware Security Advisory CVE numbers:
  CVE-2015-2344, CVE-2016-2075
1. Summary

VMware vRealize Automation and vRealize Business Advanced and Enterprise address Cross-Site Scripting (XSS) issues.

2. Relevant Releases

VMware vRealize Automation 6.x prior to 6.2.4
VMware vRealize Business Advanced and Enterprise 8.x prior to 8.2.5

 

3. Problem Description

a. Important Stored Cross-Site Scripting (XSS) issue in VMware vRealize Automation

VMware vRealize Automation contains a vulnerability that may allow for a Stored Cross-Site Scripting (XSS) attack. Exploitation of this issue may lead to the compromise of a vRA user's client workstation.

VMware would like to thank Lukasz Plonka for reporting this issue to us.


The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2015-2344 to this issue.

Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.

VMware Product
Product Version
Running on
Replace with/ Apply Patch
VMware Product VMware vRealize Automation
Product Version 7.x
Running on Linux
Replace with/ Apply Patch not affected
VMware Product VMware vRealize Automation
Product Version 6.x
Running on Linux
Replace with/ Apply Patch 6.2.4
VMware Product VMware vRealize Automation
Product Version 5.x
Running on Windows
Replace with/ Apply Patch not affected

b. Important Stored Cross-Site Scripting (XSS) issue in vRealize Business Advanced and Enterprise

VMware vRealize Business Advanced and Enterprise contains a vulnerability that may allow for a Stored Cross-Site Scripting (XSS) attack. Exploitation of this issue may lead to the compromise of a vRB user's client workstation.

VMware would like to thank Alvaro Trigo Martin de Vidales of Deloitte Spain for reporting this issue to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2016-2075 to this issue.

Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.

VMware Product
Product Version
Running on
Replace with/ Apply Patch
VMware Product VMware vRealize Business Advanced and Enterprise
Product Version 8.x
Running on Linux
Replace with/ Apply Patch 8.2.5
VMware Product VMware vRealize Business Advanced and Enterprise
Product Version 7.x
Running on Linux
Replace with/ Apply Patch not affected
VMware Product VMware vRealize Automation
Product Version 6.x
Running on Linux
Replace with/ Apply Patch not affected

4. Solution

 

Please review the patch/release notes for your product and version and verify the checksum of your downloaded file.

VMware vRealize Automation 6.2.4
Downloads and Documentation


VMware vRealize Business Advanced and Enterprise 8.2.5
Downloads and Documentation

 

5. References


http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2344
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2075

 

6. Change log


2016-03-15 VMSA-2016-0003 Initial security advisory in conjunction with the release of VMware vRealize Automation 6.2.4 and VMware vRealize Business Advanced and Enterprise 8.2.5 on 2016-03-15.

 

7. Contact

 

E-mail list for product security notifications and announcements:

http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

 

This Security Advisory is posted to the following lists:

security-announce at lists.vmware.com

bugtraq at securityfocus.com

fulldisclosure at seclists.org

 

E-mail: security at vmware.com

PGP key at: https://kb.vmware.com/kb/1055

 

VMware Security Advisories

http://www.vmware.com/security/advisories

 

Consolidated list of VMware Security Advisories

http://kb.vmware.com/kb/2078735

 

VMware Security Response Policy

https://www.vmware.com/support/policies/security_response.html

 

VMware Lifecycle Support Phases

https://www.vmware.com/support/policies/lifecycle.html

 

Twitter

https://twitter.com/VMwareSRC

 

Copyright 2016 VMware Inc. All rights reserved.

Sign up for Security Advisories

Enter your email address: