VMWare vCenter takeover via vCloud Director (CVE-2020–3956 filed by Citadelo on June 1st, 2020)

VMWare vCenter takeover via vCloud Director (CVE-2020–3956 filed by Citadelo on June 1st, 2020)

Security researchers at Citadelo revealed an EL (Expression Language) based Injection vulnerability that enabled an authenticated actor to send a malicious payload (via API calls or intercepted Web request) that led toprivilege ...