CVE-2020-3956: Code Injection
VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly handle input leading to a code injection vulnerability. An authenticated actor may be able to send malicious traffic to VMware Cloud Director which may lead to arbitrary remote code execution. This vulnerability can be exploited through the HTML5- and Flex-based UIs, the API Explorer interface and API access.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-3956?
CVE-2020-3956 is a code injection vulnerability in VMware Cloud Director.
What is the severity of CVE-2020-3956?
CVE-2020-3956 has a severity rating of 8.8, which is classified as high.
Which versions of VMware Cloud Director are affected by CVE-2020-3956?
VMware Cloud Director versions 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 are affected by CVE-2020-3956.
How does CVE-2020-3956 affect VMware Cloud Director?
CVE-2020-3956 allows an authenticated actor to send malicious traffic to VMware Cloud Director, potentially leading to arbitrary code execution.
How can I fix CVE-2020-3956?
To fix CVE-2020-3956, you should upgrade to VMware Cloud Director version 10.0.0.2, 9.7.0.5, 9.5.0.6, or 9.1.0.4, which include the necessary security patches.