CVE-2020-3956 Code injection in VMware Cloud Director
An authenticated attacker can achieve arbitrary remote code execution in VMware Cloud Director via malicious traffic through UIs or APIs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-3956?
CVE-2020-3956 is a high-severity code injection vulnerability in VMware Cloud Director, published on 20 May 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly handle input leading to a code injection vulnerability. An authenticated actor may be able to send malicious traffic to VMware Cloud Director which may lead to arbitrary remote code execution. This vulnerability can be exploited through the HTML5- and Flex-based UIs, the API Explorer interface and API access.
Weakness: CWE-917
Which versions are affected by CVE-2020-3956?
It affects 1 product.
Products include Vmware Vcloud Director.
How do I fix CVE-2020-3956?
No fix has been published for CVE-2020-3956 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-3956 being exploited?
There is no known exploitation of CVE-2020-3956 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry and 1 proofs of concept on GitHub.
Other vulnerabilities in VMware Cloud Director
Sources
Also known as GHSA-6m5g-75wx-jxgj.