CVE-2014-1209
published 2014-04-11CVE-2014-1209: VMware vSphere Client 4.0, 4.1, 5.0 before Update 3, and 5.1 before Update 2 does not properly validate updates to Client files, which allows remote attackers…
PriorityP349critical9.3CVSS 2.0
AVNACMAuNCCICAC
EPSS
3.77%
88.7th percentile
VMware vSphere Client 4.0, 4.1, 5.0 before Update 3, and 5.1 before Update 2 does not properly validate updates to Client files, which allows remote attackers to trigger the downloading and execution of an arbitrary program via unspecified vectors.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | esxi | — | — |
| vmware | vcenter_server | — | — |
| vmware | vmware_vsphere | — | — |
| vmware | vsphere_client | — | — |
| vmware | vsphere_client | — | — |
| vmware | vsphere_client | — | — |
| vmware | vsphere_client | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VMware
VMware vSphere Client updates address security vulnerabilities
vendor_vmware·2014-04-10·CVSS 9.3
CVE-2014-1209 [CRITICAL] VMware vSphere Client updates address security vulnerabilities
VMSA-2014-0003: VMware vSphere Client updates address security vulnerabilities
a. vSphere Client Insecure Client Download vSphere Client contains a vulnerability in accepting an updated vSphere Client file from an untrusted source. The vulnerability may allow a host to direct vSphere Client to download and execute an arbitrary file from any URI. This issue can be exploited if the host has been compromised or if a user has been tricked into clicking a malicious link. VMware would like to thank Recurity Labs GmbH and the Bundesamt Sicherheit in der Informationstechnik (BSI) for reporting this issue to us The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2014-1209 to this issue. Column 4 of the following table lists the action required to remediate th
GHSA
GHSA-m44w-gjg8-h4qj: VMware vSphere Client 4
ghsa_unreviewed·2022-05-17
CVE-2014-1209 [HIGH] CWE-20 GHSA-m44w-gjg8-h4qj: VMware vSphere Client 4
VMware vSphere Client 4.0, 4.1, 5.0 before Update 3, and 5.1 before Update 2 does not properly validate updates to Client files, which allows remote attackers to trigger the downloading and execution of an arbitrary program via unspecified vectors.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2014-04-11
Published