Synopsis :

The remote web server has a cross-site scripting vulnerability.

Description :

The version of VMware vCenter Update Manager running on the remote
host has a cross-site scripting vulnerability. This is due to a bug
in Jetty, the underlying web server. When Jetty displays a directory
listing, arbitrary text can be inserted into the page.

A remote attacker could exploit this by tricking a user into making a
maliciously crafted request, resulting in the execution of arbitrary
script code.

It is likely this version of Update Manager also has a directory
traversal vulnerability, though Nessus did not check for that issue.

See also :

http://jira.codehaus.org/browse/JETTY-1004
http://www.vmware.com/security/advisories/VMSA-2010-0012.html
http://kb.vmware.com/kb/1023962

Solution :

Apply the update referenced in VMware's advisory.

Risk factor :

Medium / CVSS Base Score : 4.3
(CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS Temporal Score : 3.6
(CVSS2#E:F/RL:OF/RC:C)
Public Exploit Available : true