Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2011-4404 | First vendor Publication | 2011-11-18 |
| Vendor | Cve | Last vendor Modification | 2011-12-13 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:N/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| The default configuration of the HTTP server in Jetty in vSphere Update Manager in VMware vCenter Update Manager 4.0 before Update 4 and 4.1 before Update 2 allows remote attackers to conduct directory traversal attacks and read arbitrary files via unspecified vectors, a related issue to CVE-2009-1523. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4404 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-16 | Configuration |
CPE : Common Platform Enumeration
ExploitDB Exploits
| id | Description |
|---|---|
| 2011-11-21 | VMware Update Manager Directory Traversal |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 54186 | Jetty HTTP Server Document Root Traversal Arbitrary File Access Jetty contains a flaw that allows a remote attacker to access files outside of the web path. The issue is due to the ResourceHandler and DefaultServlet's alias handling not properly sanitizing user input, specifically directory traversal style attacks (../../). |
Information Assurance Vulnerability Management (IAVM)
| Date | Description |
|---|---|
| 2011-12-01 | IAVM : 2011-A-0160 - Multiple Vulnerabilities in VMware vCenter Server 4.0 and vCenter Update Mana... Severity : Category I - VMSKEY : V0030769 |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2011-11-28 | Name : An application on the remote web server has a directory traversal vulnerability. File : vmware_vcenter_update_mgr_vmsa-2011-0014.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2021-05-04 12:17:52 |
|
| 2021-04-22 01:21:10 |
|
| 2020-05-23 13:16:58 |
|
| 2020-05-23 00:32:13 |
|
| 2015-06-10 21:26:00 |
|
| 2014-02-17 11:06:17 |
|
| 2013-11-11 12:39:39 |
|
| 2013-05-10 23:10:52 |
|
