Summary
generated automatically from NVD dataVMware vCenter Update Manager 4.0 before Update 4 and 4.1 before Update 2 ship with a default Jetty HTTP server configuration in vSphere Update Manager that is vulnerable to directory traversal. Remote attackers can exploit it through unspecified vectors to read arbitrary files on the system. The issue is related to CVE-2009-1523 and carries a CVSS v2.0 score of 5.0 (MEDIUM), with confidentiality impact only.
NVD description
The default configuration of the HTTP server in Jetty in vSphere Update Manager in VMware vCenter Update Manager 4.0 before Update 4 and 4.1 before Update 2 allows remote attackers to conduct directory traversal attacks and read arbitrary files via unspecified vectors, a related issue to CVE-2009-1523.
EPSS · FIRST.org
58.9%probability of exploitation in the next 30 days
Higher than 99% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.
CVSS v2.0 Score
Information
- Published
- 19 nov. 2011
- Updated
- 16 juin 2026
- Status
- Modified
- Source
- cve@mitre.org
Affected products
Weaknesses (CWE)
References (8)
- http://www.vmware.com/security/advisories/VMSA-2011-0014.htmlPatchVendor Advisory
- http://www.vmware.com/security/advisories/VMSA-2011-0014.htmlPatchVendor Advisory
Similar CVEs
Other vulnerabilities of type CWE-16
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.