CVE-2011-4404

2011-11-1903:58:00

CWE-16

[email protected]

web.nvd.nist.gov

114

cve-2011-4404

information security

vulnerability

jetty

vmware

vcenter update manager

directory traversal

remote attack

6.1 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.966 High

EPSS

Percentile

99.6%

JSON

The default configuration of the HTTP server in Jetty in vSphere Update Manager in VMware vCenter Update Manager 4.0 before Update 4 and 4.1 before Update 2 allows remote attackers to conduct directory traversal attacks and read arbitrary files via unspecified vectors, a related issue to CVE-2009-1523.

CPENameOperatorVersion
vmware:vcenter_update_managervmware vcenter update managereq4.1
vmware:vcenter_update_managervmware vcenter update managereq4.0