CVE-2020-3994
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2020-3994
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
VMware vCenter Server (6.7 before 6.7u3, 6.6 before 6.5u3k) contains a session hijack vulnerability in the vCenter Server Appliance Management Interface update function due to a lack of certificate validation. A malicious actor with network positioning between vCenter Server and an update repository may be able to perform a session hijack when the vCenter Server Appliance Management Interface is used to download vCenter updates.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
VMware vCenter Server 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
VMware vCenter Server是美国威睿（VMware）公司的一套服务器和虚拟化管理软件。该软件提供了一个用于管理VMware vSphere环境的集中式平台，可自动实施和交付虚拟基础架构。 VMware vCenter Server存在安全漏洞，该漏洞源于设备管理接口更新功能中包含一个会话劫持漏洞，因为缺少证书验证。当vCenter服务器设备管理接口用于下载vCenter更新时，网络定位在vCenter服务器和更新存储库之间的攻击者可能会执行会话劫持。以下产品及版本受到影响：6.7系列6.7
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | vCenter Server | vCenter Server (6.7 before 6.7u3, 6.6 before 6.5u3k) | - |
II. Public POCs for CVE-2020-3994
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-3994
请登录查看更多情报信息。
Vendor Advisories for CVE-2020-3994 (1)
- https://www.vmware.com/security/advisories/VMSA-2020-0023.htmlx_refsource_MISC
Same Patch Batch · n/a · 2020-10-20 · 17 CVEs total
| CVE-2020-7749 | 7.6 HIGH | Server-side Request Forgery (SSRF) |
| CVE-2020-7747 | 6.3 MEDIUM | Cross-site Scripting (XSS) |
| CVE-2020-7748 | 5.6 MEDIUM | Prototype Pollution |
| CVE-2020-25157 | Advantech R-SeeNet SQL注入漏洞 | |
| CVE-2020-5791 | Nagios XI和Nagios 操作系统命令注入漏洞 | |
| CVE-2020-5790 | Nagios XI 跨站请求伪造漏洞 | |
| CVE-2020-5792 | Nagios XI 参数注入漏洞 | |
| CVE-2020-15931 | Netwrix Account Lockout Examiner 安全漏洞 | |
| CVE-2020-24765 | Mind iMind Server 信息泄露漏洞 | |
| CVE-2019-9080 | DomainMod 加密问题漏洞 | |
| CVE-2020-3995 | VMware ESXi 安全漏洞 | |
| CVE-2020-3993 | VMware NSX-T 安全漏洞 | |
| CVE-2020-3992 | VMware ESXi 资源管理错误漏洞 | |
| CVE-2020-3982 | VMware ESXi 安全漏洞 | |
| CVE-2020-3981 | VMware ESXi 安全漏洞 | |
| CVE-2020-25648 | NSS 安全漏洞 |
IV. Related Vulnerabilities
Same product: vCenter Server
V. Comments for CVE-2020-3994
No comments yet