Vcenter Server Appliance CVE-2014-3790

CRITICAL

Permissions, Privileges, and Access Controls (CWE-264)

2014-06-01 cve@mitre.org

Privilege Escalation VMware Vcenter Server Appliance

9.0

CVSS 2.0 · NVD

Share

Severity by source

NVD PRIMARY

9.0 CRITICAL

AV:N/AC:L/Au:S/C:C/I:C/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:S/C:C/I:C/A:C

Attack Vector

Network

Attack Complexity

Low

Confidentiality

C

Integrity

C

Availability

C

Lifecycle Timeline

1

CVE Published

Jun 01, 2014 - 04:29 cve.org

CRITICAL 9.0

DescriptionCVE.org

Ruby vSphere Console (RVC) in VMware vCenter Server Appliance allows remote authenticated users to execute arbitrary commands as root by escaping from a chroot jail.

AnalysisAI

Ruby vSphere Console (RVC) in VMware vCenter Server Appliance allows remote authenticated users to execute arbitrary commands as root by escaping from a chroot jail. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-264. Ruby vSphere Console (RVC) in VMware vCenter Server Appliance allows remote authenticated users to execute arbitrary commands as root by escaping from a chroot jail. Affected products include: Vmware Vcenter Server Appliance.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Vcenter Server Appliance

View all

CVE-2013-3080 CRITICAL Act Now

VMware vCenter Server Appliance (vCSA) 5.1 before Update 1 allows remote authenticated users to create or overwrite arbi

CVE-2013-3079 CRITICAL Act Now

VMware vCenter Server Appliance (vCSA) 5.1 before Update 1 allows remote authenticated users to execute arbitrary progra

CVE-2012-6326 HIGH This Week

VMware vCenter Server 4.1 before Update 3 and 5.0 before Update 2, and vCSA 5.0 before Update 2, allows remote attackers

CVE-2013-1659 HIGH This Week

VMware vCenter Server 4.0 before Update 4b, 5.0 before Update 2, and 5.1 before 5.1.0b; VMware ESXi 3.5 through 5.1; and

CVE-2014-4258 MEDIUM This Month

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier and 5.6.17 and earlier allows

CVE-2014-4241 MEDIUM This Month

Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0 and 10.3.6.0 allo

CVE-2014-3797 MEDIUM This Month

Cross-site scripting (XSS) vulnerability in VMware vCenter Server Appliance (vCSA) 5.1 before Update 3 allows remote att

CVE-2014-8371 MEDIUM This Month

VMware vCenter Server Appliance (vCSA) 5.5 before Update 2, 5.1 before Update 3, and 5.0 before Update 3c does not prope

CVE-2013-3107 MEDIUM This Month

VMware vCenter Server 5.1 before Update 1, when anonymous LDAP binding for Active Directory is enabled, allows remote at

CVE-2012-6325 MEDIUM This Month

VMware vCenter Server Appliance (vCSA) 5.0 before Update 2 does not properly parse XML documents, which allows remote au

CVE-2012-6324 MEDIUM This Month

Directory traversal vulnerability in VMware vCenter Server Appliance (vCSA) 5.0 before Update 2 and 5.1 before Patch 1 a

Same weakness CWE-264 – Permissions, Privileges, and Access Controls

View all

CVE-2013-0422 CRITICAL POC

CVE-2016-10372 CRITICAL POC

CVE-2014-9583 CRITICAL POC

CVE-2012-0297 CRITICAL POC

CVE-2015-7709 CRITICAL POC

CVE-2014-0514 CRITICAL POC

CVE-2013-6955 CRITICAL POC

CVE-2012-0299 CRITICAL POC

Same technique Privilege Escalation

View all

CVE-2025-47812 CRITICAL POC

CVE-2013-0422 CRITICAL POC

CVE-2013-0632 CRITICAL POC

CVE-2017-5689 CRITICAL POC

CVE-2017-12635 CRITICAL POC

CVE-2016-10372 CRITICAL POC

CVE-2014-9583 CRITICAL POC

CVE-2012-0297 CRITICAL POC

Share

CVE-2014-3790 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy