CVEs-PoC/2017/CVE-2017-4952.md

### [CVE-2017-4952](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-4952)
![](https://img.shields.io/static/v1?label=Product&message=VMware%20Xenon&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=1.x%20prior%20to%201.5.4-CR7_1%2C%201.5.7_7%2C%201.5.4-CR6_2%2C%201.3.7-CR1_2%2C%201.1.0-CR0-3%2C%201.1.0-CR3_1%2C1.4.2-CR4_1%2C%20and%201.5.4_8.%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Authentication%20bypass%20vulnerability&color=brightgreen)

### Description

VMware Xenon 1.x, prior to 1.5.4-CR7_1, 1.5.7_7, 1.5.4-CR6_2, 1.3.7-CR1_2, 1.1.0-CR0-3, 1.1.0-CR3_1,1.4.2-CR4_1, and 1.5.4_8, contains an authentication bypass vulnerability due to insufficient access controls for utility endpoints. Successful exploitation of this issue may result in information disclosure.

### POC

#### Reference
- https://github.com/vmware/xenon/commit/5682ef8d40569afd00fb9a5933e7706bb5b66713

#### Github
No PoCs found on GitHub currently.