Unscored severity · published Nov 10, 2009
CVE-2009-3923
The VirtualBox 2.0.8 and 2.0.10 web service in Sun Virtual Desktop Infrastructure (VDI) 3.0 does not require authentication, which allows remote attackers to obtain unspecified…
–
CVSS
2.4%
EPSS
No
On KEV
Description
The VirtualBox 2.0.8 and 2.0.10 web service in Sun Virtual Desktop Infrastructure (VDI) 3.0 does not require authentication, which allows remote attackers to obtain unspecified access via vectors involving requests to an Apache HTTP Server.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VD
Virtual Desktop Infrastructure · Sun
3.0 · source: NVD
VI
Virtualbox · Sun
2.0.8; 2.0.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-3923
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-3923
Patch
http://sunsolve.sun.com/search/document.do?assetkey=1-21-141481-03-1
sunsolve.sun.com
http://sunsolve.sun.com/search/document.do?assetkey=1-66-268328-1
Patch
http://www.securityfocus.com/bid/36917
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/54136
More from Virtual Desktop Infrastructure
–
CVE-2009-2856
Sun Virtual Desktop Infrastructure (VDI) 3.0, when anonymous binding is enabled, does not properly handle a client's attempt to establish an authenticated and encrypted…