CVE-2020-3955

Severity: critical (CVSS 9.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-04-29 · updated 2026-06-17
Weakness: CWE-79

Description

ESXi 6.5 without patch ESXi650-201912104-SG and ESXi 6.7 without patch ESXi670-202004103-SG do not properly neutralize script-related HTML when viewing virtual machines attributes. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.3.

Affected products

VMware ESXi: 6.5-2, 6.5-650-201701001, 6.5-650-201703001, 6.5-650-201703002, 6.5-650-201704001, 6.5-650-201707101 (+171); 6.5, 6.7
VMware ESXi: ESXi 6.5 without patch ESXi650-201912104-SG, ESXi 6.7 without patch ESXi670-202004103-SG

References

https://www.vmware.com/security/advisories/VMSA-2020-0008.html
https://www.vmware.com/security/advisories/VMSA-2020-0008.html

Get alerted when CVE-2020-3955 or the next vulnerability affects your stack