CVE-2008-3514
VMware VirtualCenter 2.5 before Update 2 and 2.0.2 before Update 5 relies on client-side "enabled/disabled functionality" for access control, which allows remote attackers to determine valid user names by enabling functionality in the GUI and then…
Does this matter?
Lower severity and a low EPSS score (1.81%). Track it; it rarely justifies an emergency change on its own.
Description
VMware VirtualCenter 2.5 before Update 2 and 2.0.2 before Update 5 relies on client-side "enabled/disabled functionality" for access control, which allows remote attackers to determine valid user names by enabling functionality in the GUI and then making an "attempt to assign permissions to other system users."
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 1.81% probability · 77th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- vmware/virtualcenter
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/31468Vendor Advisory
- http://securityreason.com/securityalert/4150
- http://www.insomniasec.com/advisories/ISVA-080812.1.htm
- http://www.securityfocus.com/archive/1/495386/100/0/threaded
- http://www.securityfocus.com/bid/30664
- http://www.securitytracker.com/id?1020693
- http://www.vmware.com/security/advisories/VMSA-2008-0012.htmlPatch, Vendor Advisory
- http://www.vmware.com/support/vi3/doc/releasenotes_vc202u5.html
- http://www.vupen.com/english/advisories/2008/2363Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44425
- http://secunia.com/advisories/31468Vendor Advisory
- http://securityreason.com/securityalert/4150
- http://www.insomniasec.com/advisories/ISVA-080812.1.htm
- http://www.securityfocus.com/archive/1/495386/100/0/threaded
- http://www.securityfocus.com/bid/30664
- http://www.securitytracker.com/id?1020693
- http://www.vmware.com/security/advisories/VMSA-2008-0012.htmlPatch, Vendor Advisory
- http://www.vmware.com/support/vi3/doc/releasenotes_vc202u5.html
- http://www.vupen.com/english/advisories/2008/2363Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44425
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.