CVE-2017-4947 — VMware vRealize Automation (7.3 and 7.2) and vSphere Integrated Containers (1.x before 1.3) contain a deserialization vulnerability via Xenon

Back Back to CVE browser

CRITICAL

VMware vRealize Automation (7.3 and 7.2) and vSphere Integrated Containers (1.x before 1.3) contain a deserialization vulnerability via Xenon

Published Jan 29, 2018

9.8

CRITICAL

CVSS 3.0

EPSS 8.59%

Description

VMware vRealize Automation (7.3 and 7.2) and vSphere Integrated Containers (1.x before 1.3) contain a deserialization vulnerability via Xenon. Successful exploitation of this issue may allow remote attackers to execute arbitrary code on the appliance.

Affected products

Vendor VMware Product vRealize Automation Default
unaffected
- Version
  7.3 and 7.2
  Status
  affected
  Constraints
  -
Vendor VMware Product vSphere Integrated Containers Default
unaffected
- Version
  1.x before 1.3
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

VMware

vRealize Automation

unaffected

Version	Status	Constraints
7.3 and 7.2	affected	-

VMware

vSphere Integrated Containers

unaffected

Version	Status	Constraints
1.x before 1.3	affected	-

Remediation

No remediation recorded yet.

Metrics

8.59% 0.08588

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.08588

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (27 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	8.59% (0.08588)	94.92th	v5 (v2026.06.15)
Aug 23, 2026	7.69% (0.07693)	94.23th	v5 (v2026.06.15)
Jun 15, 2026	8.75% (0.08749)	94.46th	v5 (v2026.06.15)
Nov 21, 2025	26.64% (0.26641)	96.13th	v4 (v2025.03.14)
Nov 18, 2025	18.02% (0.18019)	94.67th	v4 (v2025.03.14)
Mar 30, 2025	27.60% (0.27602)	96.01th	v4 (v2025.03.14)
Mar 29, 2025	42.39% (0.42392)	96.20th	v4 (v2025.03.14)
Mar 17, 2025	27.60% (0.27602)	96.02th	v4 (v2025.03.14)
Feb 10, 2025	10.65% (0.10652)	95.09th	v3 (v2023.03.01)
Jan 1, 2025	9.04% (0.09035)	94.62th	v3 (v2023.03.01)
Dec 17, 2024	10.55% (0.10548)	95.01th	v3 (v2023.03.01)
Jul 22, 2024	3.49% (0.03488)	91.63th	v3 (v2023.03.01)
Feb 11, 2024	4.63% (0.04628)	92.25th	v3 (v2023.03.01)
Jan 9, 2024	3.70% (0.03698)	90.84th	v3 (v2023.03.01)
Dec 9, 2023	3.76% (0.03757)	90.85th	v3 (v2023.03.01)
Nov 14, 2023	5.08% (0.05081)	92.07th	v3 (v2023.03.01)
Aug 1, 2023	5.86% (0.05860)	92.39th	v3 (v2023.03.01)
Jun 22, 2023	6.08% (0.06083)	92.45th	v3 (v2023.03.01)
Mar 7, 2023	6.78% (0.06778)	92.73th	v3 (v2023.03.01)
Mar 6, 2023	5.79% (0.05785)	90.41th	v2 (v2022.01.01)
Oct 26, 2022	5.79% (0.05785)	90.10th	v2 (v2022.01.01)
Apr 1, 2022	5.63% (0.05634)	89.29th	v2 (v2022.01.01)
Feb 4, 2022	5.63% (0.05634)	76.84th	v2 (v2022.01.01)
Feb 3, 2022	2.28% (0.02278)	50.99th	v1
Jan 6, 2022	2.28% (0.02278)	50.49th	v1
Sep 1, 2021	2.28% (0.02278)	78.03th	v1
Apr 14, 2021	2.28% (0.02278)	0.00th	v1

Weaknesses (1)

CWE-502

Deserialization of Untrusted Data

References (4)

http://www.securityfocus.com/bid/102852
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040289
vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040290
vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://www.vmware.com/security/advisories/VMSA-2018-0006.html
x_refsource_CONFIRMPatchVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/102852		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040289		vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040290		vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://www.vmware.com/security/advisories/VMSA-2018-0006.html		x_refsource_CONFIRMPatchVendor Advisory