CVE-2013-5971

2013-10-2110:54:30

CWE-264

[email protected]

web.nvd.nist.gov

cve-2013-5971

session fixation

vsphere

vmware

vcenter server

web client server

remote attack

privilege escalation

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

6.7 Medium

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

76.7%

JSON

Session fixation vulnerability in the vSphere Web Client Server in VMware vCenter Server 5.0 before Update 3 allows remote attackers to hijack web sessions and gain privileges via unspecified vectors.

Affected configurations

NVD

Node

vmwarevcenter_serverRange≤5.0update_2_rc

vmwarevcenter_serverMatch4.0.0.10021

vmwarevcenter_serverMatch4.0.0.12305

vmwarevcenter_serverMatch4.1

vmwarevcenter_serverMatch4.1.0.12319

vmwarevcenter_serverMatch4.1.0.14766

vmwarevcenter_serverMatch4.1.0.17435

vmwarevcenter_serverMatch5.0

vmwarevcenter_serverMatch5.0update_1

CPENameOperatorVersion
vmware:vcenter_servervmware vcenter serverle5.0
vmware:vcenter_servervmware vcenter servereq4.0.0.10021
vmware:vcenter_servervmware vcenter servereq4.0.0.12305
vmware:vcenter_servervmware vcenter servereq4.1
vmware:vcenter_servervmware vcenter servereq4.1.0.12319
vmware:vcenter_servervmware vcenter servereq4.1.0.14766
vmware:vcenter_servervmware vcenter servereq4.1.0.17435

CPE	Name	Operator	Version
vmware:vcenter_server	vmware vcenter server	le	5.0
vmware:vcenter_server	vmware vcenter server	eq	4.0.0.10021
vmware:vcenter_server	vmware vcenter server	eq	4.0.0.12305
vmware:vcenter_server	vmware vcenter server	eq	4.1
vmware:vcenter_server	vmware vcenter server	eq	4.1.0.12319
vmware:vcenter_server	vmware vcenter server	eq	4.1.0.14766
vmware:vcenter_server	vmware vcenter server	eq	4.1.0.17435