CVE-2013-3079: vmware vcenter_server_appliance Code Injection

Vulnerability summary

CVE-2013-3079 is a high (CVSS 9.0) Code Injection vulnerability in vmware vcenter_server_appliance. EPSS estimates a 1.74% chance of exploitation in the next 30 days, higher than 77.3% of scored vulnerabilities.

Timeline

1. 01-05-2013
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

VMware vCenter Server Appliance (vCSA) 5.1 before Update 1 allows remote authenticated users to execute arbitrary programs with root privileges by leveraging Virtual Appliance Management Interface (VAMI) access.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.