CVE-2009-0518: VMware Esx

Low severity, CVSS 2.1. EPSS: 0.3% chance of exploitation in the next 30 days.

VI Client in VMware VirtualCenter before 2.5 Update 4, VMware ESXi 3.5 before Update 4, and VMware ESX 3.5 before Update 4 retains the VirtualCenter Server password in process memory, which might allow local users to obtain this password.

Affected products

• VMware VMware Esx: version 3.5 only
• VMware VMware ESXi: version 3.5 only
• VMware VMware Virtualcenter: version 1.1 only; version 1.2 only; version 1.3 only; version 1.3.1 only; version 1.4 only; version 1.4.1 only

Published 2009-04-06. Last modified 2026-06-16.