Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.0

vCenter Server Appliance lets logged-in users run code as root

CVE-2013-3079 · published 13 years ago
Summary

The vCenter Server Appliance (version 5.1 before Update 1) permits anyone who can log in to the management interface to start any program with full system privileges. This could let an attacker take complete control of the server. Apply the latest update or patch from VMware as soon as possible to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
vmware vcenter_server_appliance 5.1
cpe:2.3:a:vmware:vcenter_server_appliance:5.1:*:*:*:*:*:*:*
Original advisory text
VMware vCenter Server Appliance (vCSA) 5.1 before Update 1 allows remote authenticated users to execute arbitrary programs with root privileges by leveraging Virtual Appliance Management Interface ...
VMware vCenter Server Appliance (vCSA) 5.1 before Update 1 allows remote authenticated users to execute arbitrary programs with root privileges by leveraging Virtual Appliance Management Interface (VAMI) access.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.0 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published1 May 2013
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2013-3079 · NVD
Track software like this
Free during beta