CVE-2009-3733 Path traversal in n/a
Remote attackers can read arbitrary files on VMware Server, ESXi, and ESX systems due to a directory traversal vulnerability.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2009-3733?
CVE-2009-3733 is a medium-severity path traversal vulnerability in Vmware Esx, published on 2 Nov 2009. It can be exploited over the network, with no action from the victim.
Official description
Directory traversal vulnerability in VMware Server 1.x before 1.0.10 build 203137 and 2.x before 2.0.2 build 203138 on Linux, VMware ESXi 3.5, and VMware ESX 3.0.3 and 3.5 allows remote attackers to read arbitrary files via unspecified vectors.
Weakness: CWE-22
Which versions are affected by CVE-2009-3733?
It affects 3 products.
Products include Vmware Esx, Vmware Esxi, Vmware Server.
How do I fix CVE-2009-3733?
No fix has been published for CVE-2009-3733 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2009-3733 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2009-3733 exists.
Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.
Other vulnerabilities in Vmware Esx
Sources
Also known as GHSA-wfqc-2mvj-wfhf.