Unscored severity · published Aug 13, 2008
CVE-2008-3514
VMware VirtualCenter 2.5 before Update 2 and 2.0.2 before Update 5 relies on client-side "enabled/disabled functionality" for access control, which allows remote attackers to…
–
CVSS
1.8%
EPSS
No
On KEV
Description
VMware VirtualCenter 2.5 before Update 2 and 2.0.2 before Update 5 relies on client-side "enabled/disabled functionality" for access control, which allows remote attackers to determine valid user names by enabling functionality in the GUI and then making an "attempt to assign permissions to other system users."
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VI
Virtualcenter · Vmware
through 2.0.2; 2.0.2; 2.0.2; 2.0.2; 2.5; 2.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-3514
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-3514
Vendor Advisory
http://secunia.com/advisories/31468
securityreason.com
http://securityreason.com/securityalert/4150
www.insomniasec.com
http://www.insomniasec.com/advisories/ISVA-080812.1.htm
www.securityfocus.com
http://www.securityfocus.com/archive/1/495386/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/30664
www.securitytracker.com
http://www.securitytracker.com/id?1020693
More from Virtualcenter
–
CVE-2013-1405
VMware vCenter Server 4.0 before Update 4b and 4.1 before Update 3a, VMware VirtualCenter 2.5, VMware vSphere Client 4.0 before Update 4b and 4.1 before Update 3a, VMware…
–
CVE-2011-0426
Directory traversal vulnerability in vCenter Server in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1, and VMware VirtualCenter 2.5 before Update 6a, allows remote…
–
CVE-2010-1137
Cross-site scripting (XSS) vulnerability in WebAccess in VMware VirtualCenter 2.0.2 and 2.5 and VMware ESX 3.0.3 and 3.5, and the Server Console in VMware Server 1.0, allows…
–
CVE-2010-0686
WebAccess in VMware VirtualCenter 2.0.2 and 2.5, VMware Server 2.0, and VMware ESX 3.0.3 and 3.5 allows remote attackers to leverage proxy-server functionality to spoof the origin…
–
CVE-2009-2277
Cross-site scripting (XSS) vulnerability in WebAccess in VMware VirtualCenter 2.0.2 and 2.5 and VMware ESX 3.0.3 and 3.5 allows remote attackers to inject arbitrary web script or…