CVE-2009-3733 EXPLOIT
5.0
MEDIUM · CVSS 2.0 · EPSS 83.4% (pctl 100)
Patch early
A public exploit exists.
Description
Directory traversal vulnerability in VMware Server 1.x before 1.0.10 build 203137 and 2.x before 2.0.2 build 203138 on Linux, VMware ESXi 3.5, and VMware ESX 3.0.3 and 3.5 allows remote attackers to read arbitrary files via unspecified vectors.
Scoring
| CVSS | 5.0 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| EPSS | 83.38% — more likely to be exploited than 100% of all CVEs |
| Weakness | CWE-22 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2009-11-02 |
| Last modified | 2026-06-16 |
Affected (4)
| Vendor | Product |
|---|---|
| linux | linux kernel |
| vmware | esx |
| vmware | esxi |
| vmware | server |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | VMware Server 2.0.1 / ESXi Server 3.5 - Directory Traversal | 2009-10-27 |
References
- http://lists.vmware.com/pipermail/security-announce/2009/000069.html
- http://secunia.com/advisories/37186
- http://security.gentoo.org/glsa/glsa-201209-25.xml
- http://securitytracker.com/id?1023088
- http://securitytracker.com/id?1023089
- http://www.securityfocus.com/archive/1/507523/100/0/threaded
- http://www.securityfocus.com/bid/36842
- http://www.vmware.com/security/advisories/VMSA-2009-0015.html
- http://www.vupen.com/english/advisories/2009/3062
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7822
- http://lists.vmware.com/pipermail/security-announce/2009/000069.html
- http://secunia.com/advisories/37186
- http://security.gentoo.org/glsa/glsa-201209-25.xml
- http://securitytracker.com/id?1023088
- http://securitytracker.com/id?1023089
- http://www.securityfocus.com/archive/1/507523/100/0/threaded
- http://www.securityfocus.com/bid/36842
- http://www.vmware.com/security/advisories/VMSA-2009-0015.html
- http://www.vupen.com/english/advisories/2009/3062
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7822
→ the Explorer · watch your stack · NVD