Skip to content
Fencer Vulns
high 8.8

CVE-2020-3956 in the critical feed json

VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly ha…

published 2020-05-20 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-25221

cvss
8.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
21.1%
EPSS 21.1% chance of exploitation in 30 days, percentile 97%
public exploits
1
Exploit-DB

Summary

VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly handle input leading to a code injection vulnerability. An authenticated actor may be able to send malicious traffic to VMware Cloud Director which may lead to arbitrary remote code execution. This vulnerability can be exploited through the HTML5- and Flex-based UIs, the API Explorer interface and API access.

Patch / fix

  • vmware vcloud_director 9.1.0.4, 9.5.0.6, 9.7.0.5, 10.0.0.2

Timeline

  1. Published
  2. First public exploit (EDB-48540)

Exploit prediction

21.10% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-48540 vCloud Director 9.7.0.15498291 - Remote Code Execution remote, 2020-06-02
  • citadelo.com https://citadelo.com/en/blog/full-infrastructure-takeover-of-vmware-cloud-director-CVE-2020-3956/ referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/aaronsvk/CVE-2020-3956 referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/157909/vCloud-Director-9.7.0.15498291-Remote-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected products

  • n/a VMware Cloud Director

Classification

Weakness
  • CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.