CVE-2017-4928: VMware vCenter Server

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

The flash-based vSphere Web Client (6.0 prior to 6.0 U3c and 5.5 prior to 5.5 U3f) i.e. not the new HTML5-based vSphere Client, contains SSRF and CRLF injection issues due to improper neutralization of URLs. An attacker may exploit these issues by sending a POST request with modified headers towards internal services leading to information disclosure.

Affected products

• VMware vCenter Server: version 5.5 only; version 6.0 only

Published 2017-11-17. Last modified 2026-06-17.