VULNERABILITY INTELLIGENCE

CVE-2008-0923

CVSS score6.9 MEDIUM
EPSS probability0.49%
CISA KEVNot currently listed
Published2008-02-26
Last modified2026-06-16
CVSS vectorAV:L/AC:M/Au:N/C:C/I:C/A:C

Description

Directory traversal vulnerability in the Shared Folders feature for VMWare ACE 1.0.2 and 2.0.2, Player 1.0.4 and 2.0.2, and Workstation 5.5.4 and 6.0.2 allows guest OS users to read and write arbitrary files on the host OS via a multibyte string that produces a wide character string containing .. (dot dot) sequences, which bypasses the protection mechanism, as demonstrated using a "%c0%2e%c0%2e" string.

Weakness classification

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Primary references