Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-3956

VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly handle input leading to a code injection vulnerability. An authenticated actor may be able to send malicious traffic to VMware Cloud Director which may lead to arbitrary remote code execution. This vulnerability can be exploited through the HTML5- and Flex-based UIs, the API Explorer interface and API access.

Published

2020-05-20T14:15:11.610

Last Modified

2024-11-21T05:32:02.017

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.8 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

8.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-917
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application vmware vcloud_director < 9.5.0.6 Yes
Application vmware vcloud_director < 9.7.0.5 Yes
Application vmware vcloud_director < 10.0.0.2 Yes
Operating System linux linux_kernel - No
Operating System vmware photon_os - No
Application vmware vcloud_director < 9.1.0.4 Yes
Operating System linux linux_kernel - No
References