Vulnerability · Published Apr 29, 2020 · Assigned by vmware
CVE-2020-3955
Critical 9.3
In plain English
A critical-severity security flaw in ESXi from VMware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).
Severity (CVSS NVD)9.3Critical
Exploit odds (30 days)1.3%top 28.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
ESXi 6.5 without patch ESXi650-201912104-SG and ESXi 6.7 without patch ESXi670-202004103-SG do not properly neutralize script-related HTML when viewing virtual machines attributes. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.3.
Affected products (as reported)
References
- https://www.vmware.com/security/advisories/VMSA-2020-0008.html x_refsource_CONFIRM