Sign up for Security
Advisories

Enter your email address:


VMSA-2016-0003

VMware vRealize Automation and vRealize Business Advanced and Enterprise address Cross-Site Scripting (XSS) issues.

VMware Security Advisory
Advisory ID: VMSA-2016-0003
Synopsis: VMware vRealize Automation and vRealize Business Advanced and Enterprise address Cross-Site Scripting (XSS) issues.
Issue date: 2016-03-15
Updated on: 2016-03-15 (Initial Advisory)
CVE numbers: CVE-2015-2344, CVE-2016-2075
1. Summary
VMware vRealize Automation and vRealize Business Advanced and Enterprise address Cross-Site Scripting (XSS) issues.
2. Relevant Releases
VMware vRealize Automation 6.x prior to 6.2.4
VMware vRealize Business Advanced and Enterprise 8.x prior to 8.2.5
3. Problem Description
a. Important Stored Cross-Site Scripting (XSS) issue in VMware vRealize Automation

VMware vRealize Automation contains a vulnerability that may allow for a Stored Cross-Site Scripting (XSS) attack. Exploitation of this issue may lead to the compromise of a vRA user's client workstation.

VMware would like to thank Lukasz Plonka for reporting this issue to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2015-2344 to this issue.

Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.

VMware Product Running Replace with/
Product Version on Apply Patch
===== ===== ====== ==================
VMware vRealize Automation 7.x
Linux Not Affected
VMware vRealize Automation 6.x
Linux 6.2.4
VMware vRealize Automation 5.x
Windows Not Affected

b. Important Stored Cross-Site Scripting (XSS) issue in vRealize Business Advanced and Enterprise

VMware vRealize Business Advanced and Enterprise contains a vulnerability that may allow for a Stored Cross-Site Scripting (XSS) attack. Exploitation of this issue may lead to the compromise of a vRB user's client workstation.

VMware would like to thank Alvaro Trigo Martin de Vidales of Deloitte Spain for reporting this issue to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2016-2075 to this issue.

Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.

VMware Product Running Replace with/
Product Version on Apply Patch
===== ===== ====== ==================
VMware vRealize Business Advanced and Enterprise
8.x
Linux 8.2.5
VMware vRealize Business Advanced and Enterprise 7.x Linux Not Affected
VMware vRealize Business Advanced and Enterprise 6.x Linux Not Affected

4. Solution

Please review the patch/release notes for your product and version and verify the checksum of your downloaded file.

VMware vRealize Automation 6.2.4
Downloads and Documentation

VMware vRealize Business Advanced and Enterprise 8.2.5
Downloads and Documentation

6. Change log
2016-03-15 VMSA-2016-0003 Initial security advisory in conjunction with the release of VMware vRealize Automation 6.2.4 and VMware vRealize Business Advanced and Enterprise 8.2.5 on 2016-03-15.
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

This Security Advisory is posted to the following lists:

 security-announce at lists.vmware.com
 bugtraq at securityfocus.com
 fulldisclosure at seclists.org

E-mail: security at vmware.com
PGP key at: https://kb.vmware.com/kb/1055

VMware Security Advisories
http://www.vmware.com/security/advisories

Consolidated list of VMware Security Advisories
http://kb.vmware.com/kb/2078735

VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html

VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html
 
Twitter
https://twitter.com/VMwareSRC

Copyright 2016 VMware Inc.  All rights reserved.