CVE-2010-1137

VMware VirtualCenter <2.5 - XSS

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in WebAccess in VMware VirtualCenter 2.0.2 and 2.5 and VMware ESX 3.0.3 and 3.5, and the Server Console in VMware Server 1.0, allows remote attackers to inject arbitrary web script or HTML via the name of a virtual machine.

References (6)

[Patch, Vendor Advisory] http://lists.vmware.com/pipermail/security-announce/2010/000086.html

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id?1023769

[Patch, Vendor Advisory] http://www.vmware.com/security/advisories/VMSA-2010-0005.html

[Third Party Advisory, VDB Entry] https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6863

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/39037

[Third Party Advisory] http://security.gentoo.org/glsa/glsa-201209-25.xml

Scores

EPSS 0.0069

EPSS Percentile 71.5%

Classification

CWE

CWE-79

Status published

Affected Products (6)

vmware/virtualcenter

vmware/virtualcenter

vmware/server

vmware/esx_server

vmware/esx_server

n/a/n/a

Timeline

Published Apr 01, 2010

Tracked Since Feb 18, 2026