CVEvulnerability
CVE-2011-4404
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2011-11-19
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-16
Description
The default configuration of the HTTP server in Jetty in vSphere Update Manager in VMware vCenter Update Manager 4.0 before Update 4 and 4.1 before Update 2 allows remote attackers to conduct directory traversal attacks and read arbitrary files via unspecified vectors, a related issue to CVE-2009-1523.
Affected configurations
• vmware vcenter update manager 4.0
• vmware vcenter update manager 4.1
Related
Weakness · not in database (1)
References
- http://jetty.codehaus.org/jetty/jetty-6/xref/org/mortbay/jetty/handler/ResourceHandler.html jetty.codehaus.org
- http://jetty.codehaus.org/jetty/jetty-6/xref/org/mortbay/jetty/servlet/DefaultServlet.html jetty.codehaus.org
- http://www.securitytracker.com/id?1026341 www.securitytracker.com
- http://www.vmware.com/security/advisories/VMSA-2011-0014.html Patch, Vendor Advisory
- http://jetty.codehaus.org/jetty/jetty-6/xref/org/mortbay/jetty/handler/ResourceHandler.html jetty.codehaus.org
- http://jetty.codehaus.org/jetty/jetty-6/xref/org/mortbay/jetty/servlet/DefaultServlet.html jetty.codehaus.org
- http://www.securitytracker.com/id?1026341 www.securitytracker.com
- http://www.vmware.com/security/advisories/VMSA-2011-0014.html Patch, Vendor Advisory