PT-2010-2438 · Vmware · Vmware Server+2

Publicado 2010-04-01 · Atualizado 2010-04-28 · CVE-2010-0686

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions VMware VirtualCenter versions 2.0.2 through 2.5 VMware Server version 2.0 VMware ESX versions 3.0.3 through 3.5

Description The issue allows remote attackers to leverage proxy-server functionality to spoof the origin of requests via unspecified vectors, related to a "URL forwarding vulnerability." This could potentially lead to unauthorized access or actions.

Recommendations For VMware VirtualCenter versions 2.0.2 through 2.5, consider restricting access to the WebAccess component until a fix is available. For VMware Server version 2.0, restrict the use of proxy-server functionality to minimize the risk of exploitation. For VMware ESX versions 3.0.3 through 3.5, avoid using the WebAccess feature in VMware VirtualCenter to prevent potential spoofing of request origins.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2010-0686

Produtos afetados

Vmware Esxi

Vmware Server

Vmware Virtualcenter

Referências · 6

• http://securityfocus.com/bid/39037 · Correção
• http://securitytracker.com/id?1023769 · Nota
• http://lists.vmware.com/pipermail/security-announce/2010/000086.html · Aviso do Fabricante
• http://vmware.com/security/advisories/VMSA-2010-0005.html · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0686 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-0686 · Nota de Segurança