CVE-2020-3956: Code Injection
First published: Wed May 20 2020(Updated: )
VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly handle input leading to a code injection vulnerability. An authenticated actor may be able to send malicious traffic to VMware Cloud Director which may lead to arbitrary remote code execution. This vulnerability can be exploited through the HTML5- and Flex-based UIs, the API Explorer interface and API access.
Credit: security@vmware.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| VMware vCloud Director | >=9.5.0.0<9.5.0.6 | |
| VMware vCloud Director | >=9.7.0.0<9.7.0.5 | |
| VMware vCloud Director | >=10.0.0.0<10.0.0.2 | |
| Linux Linux kernel | ||
| VMware Photon OS | ||
| VMware vCloud Director | >=9.1.0.0<9.1.0.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/157909/vCloud-Director-9.7.0.15498291-Remote-Code-Execution.html
- https://citadelo.com/en/blog/full-infrastructure-takeover-of-vmware-cloud-director-CVE-2020-3956/
- https://github.com/aaronsvk/CVE-2020-3956
- https://www.vmware.com/security/advisories/VMSA-2020-0010.html
Frequently Asked Questions
What is CVE-2020-3956?
CVE-2020-3956 is a code injection vulnerability in VMware Cloud Director.
What is the severity of CVE-2020-3956?
CVE-2020-3956 has a severity rating of 8.8, which is classified as high.
Which versions of VMware Cloud Director are affected by CVE-2020-3956?
VMware Cloud Director versions 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 are affected by CVE-2020-3956.
How does CVE-2020-3956 affect VMware Cloud Director?
CVE-2020-3956 allows an authenticated actor to send malicious traffic to VMware Cloud Director, potentially leading to arbitrary code execution.
How can I fix CVE-2020-3956?
To fix CVE-2020-3956, you should upgrade to VMware Cloud Director version 10.0.0.2, 9.7.0.5, 9.5.0.6, or 9.1.0.4, which include the necessary security patches.
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/severity
- agent/author
- agent/weakness
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/vmware
- canonical/vmware vcloud director
- version/vmware vcloud director/9.5.0.0
- version/vmware vcloud director/9.7.0.0
- version/vmware vcloud director/10.0.0.0
- vendor/linux
- canonical/linux linux kernel
- canonical/vmware photon os
- version/vmware vcloud director/9.1.0.0