vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2017-4940

MEDIUM
6.1
CVSS Score
Published: December 20, 2017 at 03:00 PM UTC
Updated: June 17, 2026 at 01:19 AM UTC
1 product affected across 1 vendorESXi

Using ESXi by VMware?

Get instant alerts when new vulnerabilities affect ESXi - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM6.1
Exploit prediction
EPSS 0.9%

Description

The ESXi Host Client in VMware ESXi (6.5 before ESXi650-201712103-SG, 5.5 before ESXi600-201711103-SG and 5.5 before ESXi550-201709102-SG) contains a vulnerability that may allow for stored cross-site scripting (XSS). An attacker can exploit this vulnerability by injecting Javascript, which might get executed when other users access the Host Client.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

ESXi· VMware
95%
5.55.5 15.5 25.5 3a5.5 3b5.5 550-20170901001s5.5 before ESXi550-201709102-SG)6.06.0 16.0 1a6.0 1b6.0 26.0 36.0 3a6.0 600-2015044016.0 600-2015054016.0 600-2015071016.0 600-2015071026.0 600-2015074016.0 600-2015074026.0 600-2015074036.0 600-2015074046.0 600-2015074056.0 600-2015074066.0 600-2015074076.0 600-2015091016.0 600-2015091026.0 600-2015092016.0 600-2015092026.0 600-2015092036.0 600-2015092046.0 600-2015092056.0 600-2015092066.0 600-2015092076.0 600-2015092086.0 600-2015092096.0 600-2015092106.0 600-2015104016.0 600-2015114016.0 600-2016011016.0 600-2016011026.0 600-2016014016.0 600-2016014026.0 600-2016014036.0 600-2016014046.0 600-2016014056.0 600-2016024016.0 600-2016031016.0 600-2016031026.0 600-2016032016.0 600-2016032026.0 600-2016032036.0 600-2016032046.0 600-2016032056.0 600-2016032066.0 600-2016032076.0 600-2016032086.0 600-2016054016.0 600-2016081016.0 600-2016084016.0 600-2016084026.0 600-2016084036.0 600-2016084046.0 600-2016084056.0 600-2016104106.0 600-2016114016.0 600-2016114026.0 600-2016114036.0 600-2017021016.0 600-2017021026.0 600-2017022016.0 600-2017022026.0 600-2017022036.0 600-2017022046.0 600-2017022056.0 600-2017022066.0 600-2017022076.0 600-2017022086.0 600-2017022096.0 600-2017022106.0 600-2017022116.0 600-2017022126.0 600-2017034016.0 600-2017061016.0 600-2017061026.0 600-2017061036.0 600-2017064016.0 600-2017064026.0 600-2017064036.0 600-2017103016.0 before ESXi600-201711103-SG6.56.5 650-2017010016.5 650-2017030016.5 650-2017030026.5 650-2017040016.5 650-2017071016.5 650-2017071026.5 650-2017071036.5 650-2017072016.5 650-2017072026.5 650-2017072036.5 650-2017072046.5 650-2017072056.5 650-2017072066.5 650-2017072076.5 650-2017072086.5 650-2017072096.5 650-2017072106.5 650-2017072116.5 650-2017072126.5 650-2017072136.5 650-2017072146.5 650-2017072156.5 650-2017072166.5 650-2017072176.5 650-2017072186.5 650-2017072196.5 650-2017072206.5 650-2017072216.5 650-2017100016.5 650-2017120016.5 before ESXi650-201712103-SG

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (2)

VDB Entryx_refsource_SECTRACKThird Party Advisory
Source: [email protected]
http://www.securitytracker.com/id/1040024
x_refsource_CONFIRMVendor Advisory
Source: [email protected]
https://www.vmware.com/security/advisories/VMSA-2017-0021.html

CVSS

6.1MEDIUM[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-79

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card