Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

VMware ESXi 3.5 admin can gain extra privileges

CVE-2008-4281 · published 17 years ago
Summary

Versions of VMware ESXi and ESX 3.5 released before the October 2008 patches let an administrator who only has file‑management rights on a datastore increase their access level. This could let the user perform actions they are not supposed to, potentially exposing sensitive data or systems. Apply the latest security updates from VMware as soon as possible to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
vmware esx <= 3.5
cpe:2.3:a:vmware:esx:*:*:*:*:*:*:*:*
vmware esxi <= 3.5
cpe:2.3:a:vmware:esxi:*:*:*:*:*:*:*:*
Original advisory text
Directory traversal vulnerability in VMWare ESXi 3.5 before ESXe350-200810401-O-UG and ESX 3.5 before ESX350-200810201-UG allows administrators with the Datastore.FileManagement privilege to gain p...
Directory traversal vulnerability in VMWare ESXi 3.5 before ESXe350-200810401-O-UG and ESX 3.5 before ESX350-200810201-UG allows administrators with the Datastore.FileManagement privilege to gain privileges via unknown vectors.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published10 Nov 2008
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2008-4281 · NVD
Track software like this
Free during beta