{"id":"CVE-2009-3733","aliases":["EUVD-2009-3705","GHSA-wfqc-2mvj-wfhf"],"status":"published","title":"Directory traversal vulnerability in VMware Server 1.x before 1.0.10 build 203137 and 2.x before...","description":"Directory traversal vulnerability in VMware Server 1.x before 1.0.10 build 203137 and 2.x before 2.0.2 build 203138 on Linux, VMware ESXi 3.5, and VMware ESX 3.0.3 and 3.5 allows remote attackers to read arbitrary files via unspecified vectors.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.83378,"percentile":0.99683,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-22"],"published":"2009-11-02T15:00:00Z","modified":"2026-06-16T23:12:15Z","exploits":[{"source":"exploitdb","id":"EDB-33310","title":"VMware Server 2.0.1 / ESXi Server 3.5 - Directory Traversal","type":"remote","platform":"multiple","date":"2009-10-27","verified":true,"url":"https://www.exploit-db.com/exploits/33310"},{"source":"metasploit","id":"auxiliary/scanner/vmware/vmware_server_dir_trav","title":"VMware Server Directory Traversal Vulnerability","type":"auxiliary","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/scanner/vmware/vmware_server_dir_trav"}],"products":[{"vendor":"vmware","product":"esx"},{"vendor":"vmware","product":"esxi"},{"vendor":"vmware","product":"server"}],"references":[{"url":"http://security.gentoo.org/glsa/glsa-201209-25.xml","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7822","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","Third Party Advisory"]},{"url":"http://www.vupen.com/english/advisories/2009/3062","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Patch","Vendor Advisory"]},{"url":"http://securitytracker.com/id?1023089","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://lists.vmware.com/pipermail/security-announce/2009/000069.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/36842","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://secunia.com/advisories/37186","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link"]},{"url":"http://www.securityfocus.com/archive/1/507523/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://securitytracker.com/id?1023088","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.vmware.com/security/advisories/VMSA-2009-0015.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-3733"},{"url":"https://github.com/advisories/GHSA-wfqc-2mvj-wfhf"}],"sources":{"cve":[{"id":"CVE-2009-3733","description":"Directory traversal vulnerability in VMware Server 1.x before 1.0.10 build 203137 and 2.x before 2.0.2 build 203138 on Linux, VMware ESXi 3.5, and VMware ESX 3.0.3 and 3.5 allows remote attackers to read arbitrary files via unspecified vectors.","status":"published","published":"2009-11-02T15:00:00Z","modified":"2024-08-07T06:38:30.348Z","updated_at":"2026-11-02T14:33:24.10565Z"}],"euvd":[{"id":"EUVD-2009-3705","description":"Directory traversal vulnerability in VMware Server 1.x before 1.0.10 build 203137 and 2.x before 2.0.2 build 203138 on Linux, VMware ESXi 3.5, and VMware ESX 3.0.3 and 3.5 allows remote attackers to read arbitrary files via unspecified vectors.","status":"published","published":"2009-11-02T15:00:00Z","modified":"2024-08-07T06:38:30Z","updated_at":"2026-11-03T01:39:12.69352Z"}],"ghsa":[{"id":"GHSA-wfqc-2mvj-wfhf","title":"Directory traversal vulnerability in VMware Server 1.x before 1.0.10 build 203137 and 2.x before...","description":"Directory traversal vulnerability in VMware Server 1.x before 1.0.10 build 203137 and 2.x before 2.0.2 build 203138 on Linux, VMware ESXi 3.5, and VMware ESX 3.0.3 and 3.5 allows remote attackers to read arbitrary files via unspecified vectors.","status":"published","published":"2022-05-02T03:48:03Z","modified":"2023-01-31T05:09:17Z","cwes":["CWE-22"],"updated_at":"2026-11-02T14:49:29.970425Z"}],"nvd":[{"id":"CVE-2009-3733","description":"Directory traversal vulnerability in VMware Server 1.x before 1.0.10 build 203137 and 2.x before 2.0.2 build 203138 on Linux, VMware ESXi 3.5, and VMware ESX 3.0.3 and 3.5 allows remote attackers to read arbitrary files via unspecified vectors.","status":"published","published":"2009-11-02T15:30:00.813Z","modified":"2026-06-16T23:12:15.56Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:01:37.004244Z"}]}}