Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2020-3956

VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly handle input leading to a code injection vulnerability. An authenticated actor may be able to send malicious traffic to VMware Cloud Director which may lead to arbitrary remote code execution. This vulnerability can be exploited through the HTML5- and Flex-based UIs, the API Explorer interface and API access.

CVSS 8.8 · HighBuzz score 39.4

Buzz score

Why this CVE is surfacing

Buzz score total 39.4

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 24.9 · diversity 14.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Mention score
24.9
11 evidence mentions in the snapshot
Diversity score
14.5
5 sources across 2 categories
KEV score
0.0
No KEV entry observed
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
11 source links · newest first
  • A high-severity flaw affects VMware Workstation, Fusion and vSphere products.Security Affairs

    VMware has addressed a high-severity information disclosure vulnerability affecting its Workstation, Fusion and vSphere virtualization products. VMware has addressed a high-severity information disclosure vulnerability, tracked as CVE-2020-3960, that affects its Workstation, Fusion and vSphere virtualization products. The CVE-2020-3960 flaw was discovered by Cfir Cohen, a researcher from Google’s cloud security team. ESXi, Workstation and Fusion […]

    newssecurityaffairs.comJun 10, 2020, 11:41 PM
  • 8th June – Threat Intelligence BulletinCheck Point Research

    For the latest discoveries in cyber research for the week of 8th June 2020, please download our Threat Intelligence Bulletin. Top Attacks and Breaches Westech, a US military missile contractor, has been hit by the Maze ransomware after threat actors compromised its network and stole confidential documents from it. It is suspected that the hackers […]

    vendorresearch.checkpoint.comJun 8, 2020, 3:22 PM
  • Week in review: Zoom end-to-end encryption, 5G adoption and security, Patch Tuesday forecastHelp Net Security

    Here’s an overview of some of last week’s most interesting news and articles: VMware Cloud Director vulnerability enables a full cloud infrastructure takeover A code injection vulnerability (CVE-2020-3956) affecting VMware vCloud Director could be exploited to take over the infrastructure of cloud services, Citadelo researchers have discovered. 5G adoption, security and worldwide market trends With 5G adoption ramping up all over the world, we sat down with Chris Pearson, President of 5G Americas, to learn … More →

    newswww.helpnetsecurity.comJun 7, 2020, 7:00 AM
  • VMware Cloud Director Vulnerability Has Major Impact for Cloud ProvidersSecurityWeek

    A recently patched vulnerability affecting VMware Cloud Director has a major impact for cloud services providers as it can allow an attacker to take full control of all private clouds hosted on the same infrastructure, cybersecurity firm Citadelo revealed on Monday.

    newswww.securityweek.comJun 2, 2020, 2:21 PM
  • Cloud infrastructure operators should quickly patch VMware Cloud Director flawCSO Online

    Public and private cloud administrators who are using VMware Cloud Director should immediately apply the patch for a high-risk vulnerability that can be used by hackers to take full control of virtualized cloud infrastructure, security experts warn. VMware released fixes for the command injection flaw last month, but if left unpatched, it can be easily […]

    newswww.csoonline.comJun 2, 2020, 10:25 AM
  • VMware Cloud Director vulnerability enables a full cloud infrastructure takeoverHelp Net Security

    A code injection vulnerability (CVE-2020-3956) affecting VMware vCloud Director could be exploited to take over the infrastructure of cloud services, Citadelo researchers have discovered. About VMware vCloud Director and CVE-2020-3956 VMware Cloud Director (formerly known as vCloud Director) is a cloud service delivery platform used by public and private cloud providers to operate and manage cloud infrastructure. CVE-2020-3956 was discovered by Citadelo penetration testers during a security audit of a customer’s VMWare Cloud Director-based cloud … More →

    newswww.helpnetsecurity.comJun 2, 2020, 9:11 AM
  • Critical flaw in VMware Cloud Director allows hackers to take over company infrastructureSecurity Affairs

    Researchers disclosed a flaw in VMware Cloud Director platform, tracked as CVE-2020-3956, that could be abused to takeover corporate servers. Security researchers from hacking firm Citadelo disclosed details for a new critical vulnerability in VMware’s Cloud Director platform, tracked as CVE-2020-3956, that could be abused to takeover corporate servers. VMware Cloud Director is a cloud service-delivery platform […]

    newssecurityaffairs.comJun 2, 2020, 9:02 AM
  • 25th May – Threat Intelligence BulletinCheck Point Research

    For the latest discoveries in cyber research for the week of 25th May 2020, please download our Threat Intelligence Bulletin. Top Attacks and Breaches Thousands of Israeli websites have been defaced in an Anti-Israeli Campaign carried out by the “Hacker of Savior” group. All websites were hosted on a local Israeli hosting company called uPress, […]

    vendorresearch.checkpoint.comMay 25, 2020, 2:19 PM
  • Security Affairs newsletter Round 265Security Affairs

    A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs free for you in your email box. Elexon, a middleman in the UK power grid network hit by cyber-attack Experts reported the hack of several supercomputers across Europe A bug in Edison Mail iOS app impacted over […]

    newssecurityaffairs.comMay 24, 2020, 12:39 PM
  • VMware fixes CVE-2020-3956 Remote Code Execution issue in Cloud DirectorSecurity Affairs

    VMware has addressed a high-severity remote code execution vulnerability, tracked as CVE-2020-3956, that affects its Cloud Director product. VMware has patched a high-severity remote code execution vulnerability, tracked as CVE-2020-3956, in its Cloud Director product. The vulnerability is a code injection issue that could be exploited by an authenticated attacker to send malicious traffic to […]

    newssecurityaffairs.comMay 20, 2020, 10:17 PM
  • Remote Code Execution Vulnerability Patched in VMware Cloud DirectorSecurityWeek

    VMware informed customers on Tuesday that it has patched a high-severity remote code execution vulnerability in its Cloud Director product.

    newswww.securityweek.comMay 20, 2020, 1:20 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence