CVE-2020-3956

VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly handle input leading to a code injection vulnerability. An authenticated actor may be able to send malicious traffic to VMware Cloud Director which may lead to arbitrary remote code execution. This vulnerability can be exploited through the HTML5- and Flex-based UIs, the API Explorer interface and API access.

• CWE-917

• http://packetstormsecurity.com/files/157909/vCloud-Director-9.7.0.15498291-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://citadelo.com/en/blog/full-infrastructure-takeover-of-vmware-cloud-director-CVE-2020-3956/Exploit, Third Party Advisory
• https://github.com/aaronsvk/CVE-2020-3956Exploit, Third Party Advisory
• https://www.vmware.com/security/advisories/VMSA-2020-0010.htmlVendor Advisory
• http://packetstormsecurity.com/files/157909/vCloud-Director-9.7.0.15498291-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://citadelo.com/en/blog/full-infrastructure-takeover-of-vmware-cloud-director-CVE-2020-3956/Exploit, Third Party Advisory
• https://github.com/aaronsvk/CVE-2020-3956Exploit, Third Party Advisory
• https://www.vmware.com/security/advisories/VMSA-2020-0010.htmlVendor Advisory

Published

May 20, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-3950VMware Fusion (11.x before 11.5.2), VMware Remote Console fo…7.8
• CVE-2020-3951VMware Workstation (15.x before 15.5.2) and Horizon Client f…3.8
• CVE-2020-3952Under certain conditions, vmdir that ships with VMware vCent…9.8
• CVE-2020-3953Cross Site Scripting (XSS) vulnerability exists in VMware vR…4.8
• CVE-2020-3954Open Redirect vulnerability exists in VMware vRealize Log In…6.1
• CVE-2020-3955ESXi 6.5 without patch ESXi650-201912104-SG and ESXi 6.7 wit…9.3
• CVE-2020-3957VMware Fusion (11.x before 11.5.5), VMware Remote Console fo…7
• CVE-2020-3958VMware ESXi (6.7 before ESXi670-202004101-SG and 6.5 before …5.5
• CVE-2020-3959VMware ESXi (6.7 before ESXi670-202004101-SG and 6.5 before …3.3
• CVE-2020-3960VMware ESXi (6.7 before ESXi670-202006401-SG and 6.5 before …8.4
• CVE-2020-3961VMware Horizon Client for Windows (prior to 5.4.3) contains …7.8
• CVE-2020-3962VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before…8.2