Summary
generated automatically from NVD dataVMware vCenter Orchestrator (vCO) has an information disclosure flaw in its Web Configuration tool, which embeds the vCenter Server password in an HTML document. A remote authenticated administrator can read that document and obtain the password. The issue affects vCO 4.0 before Update 4, 4.1 before Update 2, and 4.2 before Update 1, and is rated MEDIUM with a CVSS v2.0 score of 4.0 (CWE-200).
NVD description
The Web Configuration tool in VMware vCenter Orchestrator (vCO) 4.0 before Update 4, 4.1 before Update 2, and 4.2 before Update 1 places the vCenter Server password in an HTML document, which allows remote authenticated administrators to obtain sensitive information by reading this document.
EPSS · FIRST.org
1.2%probability of exploitation in the next 30 days
Higher than 67% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-18, recomputed daily by FIRST.org.
CVSS v2.0 Score
Information
- Published
- 16 mars 2012
- Updated
- 16 juin 2026
- Status
- Modified
- Source
- cve@mitre.org
Affected products
Weaknesses (CWE)
References (12)
Similar CVEs
Other vulnerabilities of type CWE-200
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.