← Vulnerability feed

Vulnerability record · CVE-2020-3956 · published 20 May 2020

CVE-2020-3956: Vmware vcloud director expression language injection vulnerability

Vmware · Vcloud Director

VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly handle input leading to a code injection vulnerability. An authenticated actor may be able to send malicious traffic to VMware Cloud Director which may lead to arbitrary remote code execution. This vulnerability can be exploited through the HTML5- and Flex-based UIs, the API Explorer interface and API access.

8.8 CVSS 3.1 High EPSS 21% · top 2.5% CWE-917 · Expression language injection
8.8CVSS 3.1 base score, v2 6.5
21%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References, 6 tagged exploit
17 Jun 2026Last modified by NVD

Description

VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly handle input leading to a code injection vulnerability. An authenticated actor may be able to send malicious traffic to VMware Cloud Director which may lead to arbitrary remote code execution. This vulnerability can be exploited through the HTML5- and Flex-based UIs, the API Explorer interface and API access.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/157909/vCloud-Director-9.7.0.15498291-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
https://citadelo.com/en/blog/full-infrastructure-takeover-of-vmware-cloud-director-CVE-2020-3956/ ExploitThird Party Advisory
https://github.com/aaronsvk/CVE-2020-3956 ExploitThird Party Advisory
https://www.vmware.com/security/advisories/VMSA-2020-0010.html Vendor Advisory
http://packetstormsecurity.com/files/157909/vCloud-Director-9.7.0.15498291-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
https://citadelo.com/en/blog/full-infrastructure-takeover-of-vmware-cloud-director-CVE-2020-3956/ ExploitThird Party Advisory
https://github.com/aaronsvk/CVE-2020-3956 ExploitThird Party Advisory
https://www.vmware.com/security/advisories/VMSA-2020-0010.html Vendor Advisory

Track CVE-2020-3956 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-5523Vmware vcloud director vulnerabilityVMware vCloud Director for Service Providers 9.5.x prior to 9.5.0.3 update resolves a Remote Session Hijack vulnerability in the Tenant and Provider …EPSS 3.3%7.6CVE-2016-2076Vmware vcenter server improper authentication vulnerabilityClient Integration Plugin (CIP) in VMware vCenter Server 5.5 U3a, U3b, and U3c and 6.0 before U2; vCloud Director 5.5.5; and vRealize Automation Iden…EPSS 1.4%7.2CVE-2022-22966Vmware vcloud director vulnerabilityAn authenticated, high privileged malicious actor with network access to the VMware Cloud Director tenant or provider may be able to exploit a remote…EPSS 6.6%6.8CVE-2014-1211Vmware vcloud director cross-site request forgery vulnerabilityCross-site request forgery (CSRF) vulnerability in VMware vCloud Director 5.1.x before 5.1.3 allows remote attackers to hijack the authentication of …EPSS 1.3%9.0CVE-2021-45046Apache Log4j 2.15.0 Incomplete Fix Allows JNDI Lookup InjectionThe fix for CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. When a non-default Pattern Layout uses a Cont…KEVEPSS 100%analysed9.8CVE-2022-22963Spring Cloud Function routing expression SpEL injection RCESpring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions allow a user to supply a crafted SpEL expression as a routing-expression w…KEVEPSS 100%analysed9.8CVE-2022-26134Atlassian Confluence Server and Data Center OGNL injection RCEConfluence Server and Data Center contain an OGNL expression language injection flaw that lets an unauthenticated attacker execute arbitrary code on …KEVEPSS 100%analysed10.0CVE-2022-22947Spring Cloud Gateway Actuator endpoint code injectionSpring Cloud Gateway versions before 3.1.1+ and 3.0.7+ allow code injection when the Gateway Actuator endpoint is enabled, exposed and unsecured. A c…KEVEPSS 98%analysed

Source: NIST National Vulnerability Database (record CVE-2020-3956), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.