CVE-2008-3514

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-08-13 · updated 2026-06-16
Weakness: CWE-200

Description

VMware VirtualCenter 2.5 before Update 2 and 2.0.2 before Update 5 relies on client-side "enabled/disabled functionality" for access control, which allows remote attackers to determine valid user names by enabling functionality in the GUI and then making an "attempt to assign permissions to other system users."

Affected products

VMware Virtualcenter: through 2.0.2; 2.0.2, 2.0.2-update_2, 2.0.2-update_3, 2.5, 2.5-update_1

References

http://secunia.com/advisories/31468
http://securityreason.com/securityalert/4150
http://www.insomniasec.com/advisories/ISVA-080812.1.htm
http://www.securityfocus.com/archive/1/495386/100/0/threaded
http://www.securityfocus.com/bid/30664
http://www.securitytracker.com/id?1020693
http://www.vmware.com/security/advisories/VMSA-2008-0012.html
http://www.vmware.com/support/vi3/doc/releasenotes_vc202u5.html
http://www.vupen.com/english/advisories/2008/2363
https://exchange.xforce.ibmcloud.com/vulnerabilities/44425
http://secunia.com/advisories/31468
http://securityreason.com/securityalert/4150

Get alerted when CVE-2008-3514 or the next vulnerability affects your stack