Security News > 2020 > June > VMware Cloud Director Vulnerability Has Major Impact for Cloud Providers
A recently patched vulnerability affecting VMware Cloud Director has a major impact for cloud services providers as it can allow an attacker to take full control of all private clouds hosted on the same infrastructure, cybersecurity firm Citadelo revealed on Monday.
Citadelo researchers found that an authenticated attacker could exploit the vulnerability by sending specially crafted traffic to Cloud Director either via API calls or the web interface.
Various types of organizations using VMware Cloud Director are exposed to attacks due to this vulnerability, including public and private cloud providers, enterprises and government organizations.
During their tests, researchers exploited the vulnerability to access internal system databases, steal virtual machines from other customers, escalate privileges to system administrator, modify the Cloud Director login page to phish credentials, and obtain other customers' information.
VMware informed customers last week that it fixed a serious privilege escalation vulnerability in Fusion for macOS that was introduced by a previous patch.