CVE-2017-4952

VMware Xenon 1.x, prior to 1.5.4-CR7_1, 1.5.7_7, 1.5.4-CR6_2, 1.3.7-CR1_2, 1.1.0-CR0-3, 1.1.0-CR3_1,1.4.2-CR4_1, and 1.5.4_8, contains an authentication bypass vulnerability due to insufficient access controls for utility endpoints. Successful exploitation of this issue may result in information disclosure.

• CWE-732

• http://seclists.org/oss-sec/2018/q1/153Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/103093Third Party Advisory, VDB Entry
• https://github.com/vmware/xenon/commit/055ae13603f0cc3cd7cf59f20ce314bf8db583e1Patch, Third Party Advisory
• https://github.com/vmware/xenon/commit/06b9947cf603ba40fd8b03bfeb2e84528a7ab592Patch, Third Party Advisory
• https://github.com/vmware/xenon/commit/30ae41bccf418d88b52b35a81efb3c1304b798f8Patch, Third Party Advisory
• https://github.com/vmware/xenon/commit/5682ef8d40569afd00fb9a5933e7706bb5b66713Patch, Third Party Advisory
• https://github.com/vmware/xenon/commit/756d893573414eec8635c2aba2345c4dcf10b21cPatch, Third Party Advisory
• https://github.com/vmware/xenon/commit/7a747d82b80cd38d2c11a0d9cdedb71c722a2c75Patch, Third Party Advisory
• https://github.com/vmware/xenon/commit/b1fd306047ecdac82661d636ebee801a7f2b3a0aPatch, Third Party Advisory
• https://github.com/vmware/xenon/commit/c23964eb57e846126daef98ef7ed15400313e977Patch, Third Party Advisory
• https://github.com/vmware/xenon/commit/ec30db9afada9cb52852082ce4d7d0095524f3b3Patch, Third Party Advisory
• http://seclists.org/oss-sec/2018/q1/153Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/103093Third Party Advisory, VDB Entry
• https://github.com/vmware/xenon/commit/055ae13603f0cc3cd7cf59f20ce314bf8db583e1Patch, Third Party Advisory
• https://github.com/vmware/xenon/commit/06b9947cf603ba40fd8b03bfeb2e84528a7ab592Patch, Third Party Advisory
• https://github.com/vmware/xenon/commit/30ae41bccf418d88b52b35a81efb3c1304b798f8Patch, Third Party Advisory
• https://github.com/vmware/xenon/commit/5682ef8d40569afd00fb9a5933e7706bb5b66713Patch, Third Party Advisory
• https://github.com/vmware/xenon/commit/756d893573414eec8635c2aba2345c4dcf10b21cPatch, Third Party Advisory
• https://github.com/vmware/xenon/commit/7a747d82b80cd38d2c11a0d9cdedb71c722a2c75Patch, Third Party Advisory
• https://github.com/vmware/xenon/commit/b1fd306047ecdac82661d636ebee801a7f2b3a0aPatch, Third Party Advisory
• https://github.com/vmware/xenon/commit/c23964eb57e846126daef98ef7ed15400313e977Patch, Third Party Advisory
• https://github.com/vmware/xenon/commit/ec30db9afada9cb52852082ce4d7d0095524f3b3Patch, Third Party Advisory

Published

May 2, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-4946The VMware V4H and V4PA desktop agents (6.x before 6.5.1) co…
• CVE-2017-4947VMware vRealize Automation (7.3 and 7.2) and vSphere Integra…
• CVE-2017-4948VMware Workstation (14.x before 14.1.0 and 12.x) and Horizon…
• CVE-2017-4949VMware Workstation and Fusion contain a use-after-free vulne…
• CVE-2017-4950VMware Workstation and Fusion contain an integer overflow vu…
• CVE-2017-4951VMware AirWatch Console (9.2.x before 9.2.2 and 9.1.x before…
• CVE-2017-4955An issue was discovered in Pivotal PCF Elastic Runtime 1.6.x…
• CVE-2017-4956Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-4957Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-4958Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-4959An issue was discovered in Pivotal PCF Elastic Runtime 1.8.x…
• CVE-2017-4960An issue was discovered in Cloud Foundry release v247 throug…