VMSA-2016-0003:VMware vRealize Automation and vRealize Business Advanced and Enterprise address Cross-Site Scripting (XSS) issues.
VMSA-2016-0003
VMware vRealize Automation and vRealize Business Advanced and Enterprise address Cross-Site Scripting (XSS) issues.
VMware Security Advisory
1. Summary
VMware vRealize Automation and vRealize Business Advanced and Enterprise address Cross-Site Scripting (XSS) issues.
2. Relevant Releases
VMware vRealize Automation 6.x prior to 6.2.4
VMware vRealize Business Advanced and Enterprise 8.x prior to 8.2.5
3. Problem Description
a. Important Stored Cross-Site Scripting (XSS) issue in VMware vRealize Automation
VMware vRealize Automation contains a vulnerability that may allow for a Stored Cross-Site Scripting (XSS) attack. Exploitation of this issue may lead to the compromise of a vRA user's client workstation.
VMware would like to thank Lukasz Plonka for reporting this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2015-2344 to this issue.
Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.
VMware Product
Product Version
Running on
Replace with/ Apply Patch
b. Important Stored Cross-Site Scripting (XSS) issue in vRealize Business Advanced and Enterprise
VMware vRealize Business Advanced and Enterprise contains a vulnerability that may allow for a Stored Cross-Site Scripting (XSS) attack. Exploitation of this issue may lead to the compromise of a vRB user's client workstation.
VMware would like to thank Alvaro Trigo Martin de Vidales of Deloitte Spain for reporting this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2016-2075 to this issue.
Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.
VMware Product
Product Version
Running on
Replace with/ Apply Patch
4. Solution
Please review the patch/release notes for your product and version and verify the checksum of your downloaded file.
VMware vRealize Automation 6.2.4
Downloads and Documentation
VMware vRealize Business Advanced and Enterprise 8.2.5
Downloads and Documentation
5. References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2344
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2075
6. Change log
2016-03-15 VMSA-2016-0003 Initial security advisory in conjunction with the release of VMware vRealize Automation 6.2.4 and VMware vRealize Business Advanced and Enterprise 8.2.5 on 2016-03-15.
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
security-announce at lists.vmware.com
bugtraq at securityfocus.com
fulldisclosure at seclists.org
E-mail: security at vmware.com
PGP key at: https://kb.vmware.com/kb/1055
VMware Security Advisories
http://www.vmware.com/security/advisories
Consolidated list of VMware Security Advisories
http://kb.vmware.com/kb/2078735
VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html
VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html
Copyright 2016 VMware Inc. All rights reserved.