VMware vCenter Chargeback Manager Remote Code Execution (VMSA-2013-0008)

high Nessus Plugin ID 66897

Language:

Synopsis

The remote Windows host has an application installed that is potentially affected by a remote code execution vulnerability.

Description

The version of VMware vCenter Chargeback Manager installed on the remote Windows host is potentially affected by a remote code execution vulnerability due to a flaw in the handling of file uploads. By exploiting this flaw, a remote, unauthenticated attacker could execute arbitrary code subject to the privileges of the user running the application.

Solution

Upgrade to VMware vCenter Chargeback Manager 2.5.1 or later.

Plugin Details

Severity: High

ID: 66897

File Name: vmware_vcenter_chargeback_manager_251.nasl

Version: 1.8

Type: local

Agent: windows

Family: Windows

Published: 6/14/2013

Updated: 11/27/2019

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.3

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2013-3520

Vulnerability Information

CPE: cpe:/a:vmware:vcenter_chargeback_manager

Required KB Items: SMB/VMware vCenter Chargeback Manager/Version

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/11/2013

Vulnerability Publication Date: 6/11/2013

Exploitable With

Metasploit (VMware vCenter Chargeback Manager ImageUploadServlet Arbitrary File Upload)

Reference Information

CVE: CVE-2013-3520

BID: 60484

VMSA: 2013-0008

Detections

Analytics