CVE-2009-2277

VMware VirtualCenter <2.5 - VMware ESX <3.5 - XSS

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in WebAccess in VMware VirtualCenter 2.0.2 and 2.5 and VMware ESX 3.0.3 and 3.5 allows remote attackers to inject arbitrary web script or HTML via vectors related to "context data."

References (4)

[Patch, Vendor Advisory] http://lists.vmware.com/pipermail/security-announce/2010/000086.html

[Patch] http://www.securityfocus.com/bid/39037

[Patch, Vendor Advisory] http://www.vmware.com/security/advisories/VMSA-2010-0005.html

[Third Party Advisory, VDB Entry] https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7080

Scores

EPSS 0.0037

EPSS Percentile 58.2%

Classification

CWE

CWE-79

Status published

Affected Products (5)

vmware/esx_server

vmware/virtualcenter

n/a/n/a

Timeline

Published Apr 01, 2010

Tracked Since Feb 18, 2026