CVE-2020-3954
published 2020-04-15CVE-2020-3954: Open Redirect vulnerability exists in VMware vRealize Log Insight prior to 8.1.0 due to improper Input validation.
PriorityP424medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.77%
51.4th percentile
Open Redirect vulnerability exists in VMware vRealize Log Insight prior to 8.1.0 due to improper Input validation.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | vrealize_log_insight | < 8.1.0 | 8.1.0 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VMware
VMware vRealize Log Insight addresses Cross Site Scripting (XSS) and Open Redirect vulnerabilities (CVE-2020-3953, CVE-2020-3954)
vendor_vmware·2020-04-14·CVSS 4.8
CVE-2020-3953 [MEDIUM] VMware vRealize Log Insight addresses Cross Site Scripting (XSS) and Open Redirect vulnerabilities (CVE-2020-3953, CVE-2020-3954)
VMSA-2020-0007: VMware vRealize Log Insight addresses Cross Site Scripting (XSS) and Open Redirect vulnerabilities (CVE-2020-3953, CVE-2020-3954)
vRealize Log Insight does not properly validate user input, resulting in XSS vulnerabilities. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.4.
CVEs: CVE-2020-3953, CVE-2020-3954
Affected products: VMware Aria, VMware vRealize
GHSA
GHSA-2fc8-wj99-h595: Open Redirect vulnerability exists in VMware vRealize Log Insight prior to 8
ghsa_unreviewed·2022-05-24
CVE-2020-3954 [MEDIUM] CWE-601 GHSA-2fc8-wj99-h595: Open Redirect vulnerability exists in VMware vRealize Log Insight prior to 8
Open Redirect vulnerability exists in VMware vRealize Log Insight prior to 8.1.0 due to improper Input validation.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-04-15
Published