CVE-2011-4404
CVE-2011-4404 is a medium-severity vulnerability in Vmware Vcenter Update Manager with a CVSS 2.0 base score of 5.0. Its EPSS exploit-prediction score of 60% places it in the 99th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-16.
Key facts
- Severity: Medium (CVSS 2.0 base score 5.0)
- EPSS exploit prediction: 60% (99th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-16
- Affected product: Vmware Vcenter Update Manager
- Published:
- Last modified:
Description
The default configuration of the HTTP server in Jetty in vSphere Update Manager in VMware vCenter Update Manager 4.0 before Update 4 and 4.1 before Update 2 allows remote attackers to conduct directory traversal attacks and read arbitrary files via unspecified vectors, a related issue to CVE-2009-1523.
Frequently asked questions
- What is CVE-2011-4404?
- The default configuration of the HTTP server in Jetty in vSphere Update Manager in VMware vCenter Update Manager 4.0 before Update 4 and 4.1 before Update 2 allows remote attackers to conduct directory traversal attacks and read arbitrary files via unspecified vectors, a related issue to CVE-2009-1523.
- How severe is CVE-2011-4404?
- CVE-2011-4404 has a CVSS 2.0 base score of 5.0, rated medium severity.
- Is CVE-2011-4404 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 60% (99th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2011-4404?
- CVE-2011-4404 primarily affects Vmware Vcenter Update Manager. In total, 6 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2011-4404?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2011-4404 published?
- CVE-2011-4404 was published on 2011-11-19 and last updated on 2026-06-16.
References
- http://jetty.codehaus.org/jetty/jetty-6/xref/org/mortbay/jetty/handler/ResourceHandler.html
- http://jetty.codehaus.org/jetty/jetty-6/xref/org/mortbay/jetty/servlet/DefaultServlet.html
- http://www.securitytracker.com/id?1026341
- http://www.vmware.com/security/advisories/VMSA-2011-0014.html
Affected products (6)
- cpe:2.3:a:vmware:vcenter_update_manager:4.0:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_update_manager:4.0:update_1:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_update_manager:4.0:update_2:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_update_manager:4.0:update_3:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_update_manager:4.1:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_update_manager:4.1:update_1:*:*:*:*:*:*
Other CWE-16 vulnerabilities
- CVE-2013-4316 — Critical (CVSS 10.0): Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack…
- CVE-2013-1221 — Critical (CVSS 10.0): The Tomcat Web Management feature in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 does not…
- CVE-2011-4501 — Critical (CVSS 10.0): The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg,…
- CVE-2010-4586 — Critical (CVSS 10.0): The default configuration of Opera before 11.00 enables WebSockets functionality, which has unspecified impact and…
- CVE-2010-2977 — Critical (CVSS 10.0): Cisco Unified Wireless Network (UWN) Solution 7.x before 7.0.98.0 does not properly implement TLS and SSL, which has…
- CVE-2010-2276 — Critical (CVSS 10.0): The default configuration of the build process in Dojo 0.4.x before 0.4.4, 1.0.x before 1.0.3, 1.1.x before 1.1.2,…